From 7415e190e393a571378b1ea731365b54c3c24de5 Mon Sep 17 00:00:00 2001 From: null Date: Thu, 10 Sep 2026 04:08:06 -0500 Subject: [PATCH] chore(security): commit the Aug 29 scanner update left uncommitted here The 2026-08-29 cross-project update of scripts/secrets.sh reached this checkout as a working-tree edit and was never committed. For the twelve days since, .githooks/pre-push refused every push, because a tracked file was modified, so nothing else could land. Committed as-is, by Null's decision, so the work that follows can push. What the change does: - the bare NAME=value pattern can now match. It was anchored to the start of a line, and neither scan mode ever presents one: a staged diff starts every line with "+", and --tracked prefixes each line with its file name. - a commit that only deletes lines is no longer refused as a possible credential. Staged mode reads added lines only, so "nothing to scan" there is a correct measurement, not a failure to measure. Known, and fixed in the next security commit (Batch 18): the new pattern flags two comment lines, so `npm run verify` fails until then, and the private-key pattern still never runs because grep is called without -e. Co-Authored-By: Claude Opus 5 (1M context) --- scripts/secrets.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/scripts/secrets.sh b/scripts/secrets.sh index 868ab0a..1289aa8 100755 --- a/scripts/secrets.sh +++ b/scripts/secrets.sh @@ -170,7 +170,7 @@ PATTERNS=( # Anchored to the start of a line or an `export`, because unanchored it # matched `access_token = $1` in SQL and `apiKey=` in a property list — three # findings in src/ that were column names, not credentials. - '(^|export )[A-Z][A-Z0-9_]*(SECRET|TOKEN|PASSWORD|API_KEY|PASSWD)[A-Z0-9_]*=[^[:space:]"'"'"']{8,}' + '(^|[^A-Za-z0-9_])[A-Z0-9_]*(SECRET|TOKEN|PASSWORD|PASSWD|PASS|API_KEY)[A-Z0-9_]*=[^[:space:]"'"'"'$][^[:space:]"'"'"']{7,}' '-----BEGIN [A-Z ]*PRIVATE KEY-----' '\bghp_[A-Za-z0-9]{20,}' # GitHub '\bxox[baprs]-[A-Za-z0-9-]{10,}' # Slack @@ -278,6 +278,16 @@ else fi if [ -z "$CONTENT" ]; then + # "Nothing to scan" means two different things and collapsing them makes a + # DELETE-ONLY COMMIT IMPOSSIBLE. In staged mode CONTENT is built from ADDED + # lines only, so a commit that only deletes has none — a correct measurement, + # not a failure to measure, because a deletion cannot introduce a credential. + # In tracked/built mode empty means nothing was examined at all, which IS the + # could-not-check state exit 2 exists to name. + if [ "$MODE" = "staged" ]; then + say "no added lines in $WHAT — a deletion cannot introduce a credential." + exit 0 + fi say "nothing to scan in $WHAT." exit 2 fi