SEC: canonical detector catches glued-prefix credentials at egress sinks - #1621

Draft

thesongzhu wants to merge 7 commits into

mainfrom

sec-secret-detector-glued-prefix

Commits on Jul 18, 2026

fix(security): canonical secret detector catches distinctive-prefix credentials glued after a word char (leading \b evasion) across audit/realtime/memory egress sinks; bounded to high-entropy whole…
claude
committed
ff6bb58
fix(security): NO-DEGRADE regression — github-classic glued branch used a `_`-inclusive body that over-redacted benign snake_case ending in ghs/gho/ghp/ghr/ghu before `_` (walkthroughs_completed_co…
claude
committed
832cd7d
fix(security): restore leading \b on the github-classic branch — the classic prefixes are common English WORD-FRAGMENTS (-ghs ends walkthroughs/coughs/highs; "github"), so a base62 body alone still…
claude
committed
58d010f
fix(security): restore leading \b on the AWS AKIA branch — its alternation embeds English-word / base32-constructible fragments (ASIA/AIDA/AGPA) and its body is [0-9A-Z]{16} (the all-caps-constant …
claude
committed
9a7311d
chore(security): satisfy CI detect-secrets-hook on the benign AKIA-family NO-DEGRADE fixtures — add narrow inline `pragma: allowlist secret` markers to each benign ULID/all-caps/base32/high-entropy…
claude
committed
7021926
fix(security): split GitHub/AWS secret-detector alternations by prefix; de-`\b` only unambiguous members (ghp/ghr/AKIA) to catch glued credentials (SEC-SECRET-GLUED-PREFIX-001 P1)
claude
committed
2c83630

Commits on Jul 19, 2026

fix(security): AKIA de-bounding via context-sensitive negative-lookbehind — protect SLOVAKIA/CZECHOSLOVAKIA all-caps constants (SEC-SECRET-GLUED-PREFIX-001 round-5 NO-DEGRADE)
claude
committed
61b2a6d