app/stacksnipe: redact secrets in exported command lines

[aly-obol]

Problem

The stack sniping collector reads the full command line of every detected validator client and exports it verbatim in two places:

• as the cli_parameters label of the app_validator_stack_params gauge, served on the monitoring endpoint
• as a field of the Detected stack component debug log line

Validator client command lines routinely carry secret material: keystore passwords, the paths of the files holding them, and keymanager bearer tokens, among others. Exporting them unmodified moves that material into the metrics and log planes, whose readers and retention are typically much broader than the process table it was read from.

Change

Redact the values of flags whose names look sensitive (auth, jwt, key, passphrase, password, secret, token) before the command line is logged or handed to the metrics callback:

• both the --flag value and the --flag=value forms are handled
• flag names are preserved, so the telemetry keeps its diagnostic value; only values are replaced with <redacted>
• a /proc cmdline is NUL separated, so redaction normally operates per argument. If the whole command line ever arrives as a single blob, it is split on whitespace first, so redaction fails safe rather than passing the blob through untouched

Also:

• log an INFO line at startup when --proc-directory is set, so the disclosure tradeoff is visible to operators
• note the same tradeoff in the flag's help text (and the regenerated docs/configuration.md)

The feature remains disabled by default; --proc-directory still defaults to empty.

Testing

• go test ./app/stacksnipe/ passes, with two new subtests: one asserting no secret material survives export from a realistic NUL separated cmdline (while non-sensitive flags and values are untouched), and one covering the unsplit-blob fallback
• go test ./cmd -run=TestConfigReference passes, confirming docs/configuration.md matches the updated flag help
• gofmt clean

category: bug
ticket: none

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.48%. Comparing base (071b0d0) to head (242533b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4688      +/-   ##
==========================================
+ Coverage   65.38%   65.48%   +0.09%     
==========================================
  Files         247      247              
  Lines       29983    30057      +74     
==========================================
+ Hits        19605    19682      +77     
+ Misses      10377    10374       -3     
  Partials        1        1              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

Two command-line parsing edge cases can still expose sensitive values.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Redacts sensitive validator-client command-line values before exporting them to logs and metrics.

Changes:

• Adds sensitive-flag redaction for command lines.
• Warns operators when stack sniping is enabled.
• Documents and tests the disclosure behavior.

File summaries

File	Description
app/stacksnipe/stacksnipe.go	Implements redaction and startup warning.
app/stacksnipe/stacksnipe_test.go	Tests redaction behavior.
cmd/run.go	Updates flag help text.
docs/configuration.md	Regenerates configuration documentation.

Review details

Suppressed comments (1)

app/stacksnipe/stacksnipe.go:194

• A sensitive flag value may legitimately begin with - (for example, --password -hunter2). This branch treats that value as another flag and can append it unchanged, leaking it to both telemetry sinks. Since option arity is unknown here, resolve the ambiguity toward redaction while still tracking a subsequent bare sensitive flag.

		if redactNext {
			redactNext = false

			// A flag rather than a value means the previous flag was a boolean, keep walking.
			if !strings.HasPrefix(arg, "-") {
				redacted = append(redacted, redactedValue)
				continue
			}
		}

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟡 Changes recommended

Ambiguous double-dash values can leak secrets, and the promised startup warning uses INFO severity.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Balanced