Repository navigation
Conversation
thdxr
force-pushed
the
fix/secret-overmatch
branch
3 times, most recently
from
November 11, 2026 18:28
bf77e57 to
85bef1e
Compare
HTTP/2 pseudo-header sources are recognized only when the header segment directly follows the request scope in METHOD url.request.header.:name or METHOD url.response.header.:name form, with optional occurrence suffixes and whitespace-padded old spellings. Only query, fragment, request and response can directly follow the scope; json, form, multipart and header only appear after request and response. Ambiguous URL paths ending in .query or .fragment are kept, because wrongly dropping a real secret is worse than keeping a hostname. Short captured values and pseudo-header-only slots are dropped when a profile is read or written back. AuthProfile keeps an optional nextRef high-water mark, computed from the raw slots before cleaning, so a ref held by a dropped slot is never handed to a new credential. It remains readable for old profiles without the field. secrets_run only exports the remaining slots, and redacts their values from stdout/stderr instead of letting short values mangle text such as BC_SECRET_1. Add on-disk profile tests for read, status, run and ref continuity.
thdxr
force-pushed
the
fix/secret-overmatch
branch
from
November 11, 2026 18:43
85bef1e to
3109f1c
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
follow-up to the
:authorityfix. that one was an exact-name exclusion, so any other http/2 pseudo-header (or one spelled with stray whitespace) still went throughsecretNamePatternand could become a credential slot, replacing the hostname across the whole HAR.profiles from older builds are cleaned when read and before they are written back: slots shorter than 8 characters and slots whose only sources are non-
:pathpseudo-headers are dropped. a header source must beMETHOD url.request.header.:xorMETHOD url.response.header.:x; only query, fragment, request and response can directly follow the scope, and json/form/multipart/header only appear after request/response. ambiguous URL paths ending in.queryor.fragmentare kept, because wrongly dropping a real secret is worse than keeping a hostname. dropped slots are not matched by value, not counted as observed, and not exported bysecrets_run.nextRefis now stored as a high-water mark, computed from the raw slots before cleaning and persisted on write. a ref held by a dropped slot is never handed to a new credential, so old HARs and scripts that still use$BC_SECRET_2as a hostname can't receive a new token there.:prefix, so none of them can become a slot regardless of nameBC_REDACTED_nrefs, but not stored as profile slotssecrets_runredacts only the remaining profile values, so text likeBC_SECRET_1isn't mangled by a one-character slotFixes #233