Fix: [for cherry-picking] Credential and private-key rules now bypass l - #65
Conversation
|
PR author is in the excluded authors list. |
ApprovabilityVerdict: Needs human review Unable to check for correctness in 6a60628. This PR modifies security-related credential scanning scripts to make certain high-risk patterns (API keys, private keys) bypass allowlist filtering. Changes to security tooling warrant review by the designated code owners (wave-av/core-team). You can customize Macroscope's approvability policy. Learn more. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| # Credential and private-key formats are never allowlisted: a real secret must | ||
| # still block even when it appears in a policy example or an exempt line. | ||
| local matches | ||
| matches="$(printf '%s' "$raw" \ | ||
| | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \ | ||
| | rg -vNiP -- "$ABOUT_THE_CONTROL" || true)" | ||
| case "$name" in | ||
| stripe-live-key|stripe-account|anthropic-key|github-pat|supabase-pat|aws-akid|private-key) | ||
| matches="$raw" | ||
| ;; | ||
| *) | ||
| matches="$(printf '%s' "$raw" \ | ||
| | rg -vN -- 'guard:allow[[:space:]]+[^[:space:]]' \ | ||
| | rg -vNiP -- "$ABOUT_THE_CONTROL" || true)" | ||
| ;; | ||
| esac |
There was a problem hiding this comment.
🔍 Body gate now diverges from the tree gate on credential allowlisting
scripts/public-repo-guard/content-policy.sh:56-60 still lets # guard:allow <reason> suppress its credential rules (stripe-live-key, stripe-account). After this change the two halves of the same gate disagree: the same credential-shaped string is exemptible in a committed file but unconditionally blocking in a PR body. If the intent is "a real secret always blocks", the tree scanner deserves the same treatment; otherwise the divergence should be documented so operators know which surface enforces which policy.
Was this helpful? React with 👍 or 👎 to provide feedback.
Fixed Findings
Automated fix from agentic review of #64
Note
Bypass allowlist filtering for credential and private-key rules in body policy
stripe-live-key,stripe-account,anthropic-key,github-pat,supabase-pat,aws-akid, andprivate-key, thecheckfunction in body-policy.sh now skips both inlineguard:allowallowlisting andABOUT_THE_CONTROLfiltering, using raw ripgrep matches directly.guard:allowannotations no longer suppress violations for the listed credential rule names.Macroscope summarized 6a60628.