Repository navigation
fix(publish-gate): scanLeak misses credentials after a JSON-escaped newline or tab #12562
Description
Problem
scanLeak (lib/publish-gate.mjs) misses \b-anchored credential shapes when the scanned file is JSON-encoded and the token follows an escaped newline or tab. The escape leaves the letter n or t directly before the token, so no word boundary exists there. normalize keeps those sequences, so its folded pass misses too.
Measured on main with a fake GitHub-token shape built at runtime:
| Input | scanLeak |
|---|---|
| Plain text, token at line start | blocks |
JSON.stringify, token after a space |
blocks |
JSON.stringify, token at line start |
{} |
JSON.stringify, token after a tab |
{} |
Who is affected
- ci-workflows
pr-review-cli.ymlwrites the review handoff withJSON.stringify, scans it throughscan-upload, and uploads it unencrypted for one day. A token at the start of a line in model text passes that scan. - ci-workflows#969 scans the run-claude-cli execution file the same way before sealing it. There the data stays encrypted, but a missed credential raises no rotation notice.
upload-lane-transcriptin this repository passes raw bytes to the same gate. UNVERIFIED: whether its execution files have this one-line JSON form.
Likelihood is limited by the lanes' scrubbed subprocess environment and read-only tools; a token would have to reach the model through a file it can read.
Acceptance criteria
scanLeakblocks the two{}rows above, for every\b-anchored shape inSECRET_PATTERNS, with a test for each.- Text that is clean today stays clean.
normalize's comment says a tracked-tree test limits which escapes it may fold, so the fix either passes that test or adds a separate decoded pass. - The gate's plugin copies stay in sync the way they do today.
- Once released, the ci-workflows
scan-uploadresult for a JSON file with a line-start token is withheld (it fetches the gate at tip).
Activity
github-actions commentedon Nov 3, 2026
Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.
Size: Medium
Complexity: Medium
Uncertainty: Known
Flags: none
Blocked by: none
Understood:
scanLeakinlib/publish-gate.mjsmisses\b-anchored credential shapes in JSON-encoded text when the token follows an escaped newline or tab. Thenortleft before the token removes the word boundary, andnormalizekeeps those escapes. The fix needs to block those two cases for every\b-anchored shape, keep clean text clean, and keep the plugin copies in sync.The existing refinement comment already has acceptance criteria. The last item in your body, the ci-workflows
scan-uploadresult, can only be checked after release, outside this repository.No likely duplicates found among the open issues. #8295 is related but covers a different gap.
Automated triage, applied by the lanes App.
melodic-automation-lanes commentedon Nov 3, 2026
Not admitted to the issue lane yet: no trusted-human acceptance criteria: a listed human must put the confirmed
- [ ]criteria in the body or post them as their own comment, or, on an issue a listed human filed, intake's newest refinement comment must hold them unedited; intake's refinement of this body is due and may supply them.melodic-automation-lanes commentedon Nov 3, 2026
Refinement. A read-only run explored this repository, searched its issues and pull requests, and read the allowed docs to draft what follows. On an issue a listed human filed, it counts as the issue's spec once posted, while unedited; it is still model text, so check it.
Intended outcome: scanLeak blocks a credential that follows a JSON-escaped newline, tab or carriage return in JSON-encoded text, for every \b-anchored SECRET_PATTERNS shape, with clean text staying clean and the plugin copies in sync.
Acceptance criteria
External state: none
Dependencies
Related work
Sources read
Automated refinement by the lanes App. Intake triages the issue again with it.
github-actions commentedon Nov 3, 2026
github-actions commentedon Nov 3, 2026