fix(preflight): --redact the gitleaks gate so secret values never hit CI artifacts (#27)#30
Merged
Merged
Conversation
… CI artifacts (#27) The gate spawned `gitleaks detect ... -v` without --redact, then on FAIL captured the raw stdout (which includes the literal `Secret: <value>`) into the gate `details`. That serializes into preflight-report.json, which ci.yml + publish.yml upload as a CI artifact (if: always(), 14-30d retention) on a PUBLIC repo -- so the scanner that flags a leak became its own amplifier, persisting the plaintext for weeks (long after a dev scrubbed it from history via force-push/BFG). Fix: add --redact to the detect argv. gitleaks still reports the finding's location/rule/line with the value shown as REDACTED, so the gate keeps its full diagnostic value. Empirically verified against the pinned gitleaks 8.30.1: `Secret: ghp_...` plaintext without --redact, `Secret: REDACTED` with it. Test: argv-pin (matches the project's existing spawn-argv-pin pattern); mutation-checked -- fails if --redact is dropped. Installer suite 76/76; preflight 11/11 (gitleaks gate PASS on a clean tree). Found + adversarially verified during the BRIEF-assigned v1.6.4 cross- audit (dimension b); severity MEDIUM (harm is persistence-after-scrub).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #27. Adds --redact to the gitleaks preflight gate so a real finding's plaintext secret value is never serialized into preflight-report.json / uploaded as a public-repo CI artifact. Adversarial review APPROVE-WITH-NITS (verified: no second unredacted path; the argv-pin test hardened against a commented-flag loophole). Installer 76/76, preflight 11/11, check-all.sh green.