pti/wraptool
Watch
1
0
Fork
You've already forked wraptool
 0
Code Issues 2 Pull requests Projects Releases 13 Packages 5 Wiki Activity Actions

fix/executor: redact a generic Key field only when its value is secret-shaped #104

Merged
pti merged 1 commit from fix/scrub-generic-key-shape into main 2026-10-19 23:13:29 +02:00
Conversation 0 Commits 1 Files changed 4 +254 -5
pti commented 2026-10-19 23:10:39 +02:00
Owner

Closes #77. The credential scrubber redacted any field whose name ends in key, so SonarQube's metricKey, projectKey and ruleKey values came back as REDACTED in proxied MCP results. The env-value scrub was innocent. Key names now fall into three classes. Names containing token, secret, password, passwd or credential, and names containing a strong word such as api, private, access, sign, ssh, hmac, pass, crypt, cipher, session, host or admin, are redacted unconditionally as before. A generic name ending in key is redacted only when its value is secret-shaped, 32 characters or more, or 16 or more with a digit, and an array or object under such a name is redacted whole when any element inside is secret-shaped or the span is truncated. Bare key keeps its 40-character floor. Two reviewer rounds: a 300000-case differential fuzz against main including container values found no case where this branch leaks something main redacted, every difference is a generic key with a non-secret value. Round one caught two real gaps in my first cut, containers under a generic key and missing strong words, both closed with tests. Regression test uses the real Sonar quality gate and issues response shapes. CHANGELOG Fixed bullet. 🤖 Generated with Claude Code

Closes #77. The credential scrubber redacted any field whose name ends in key, so SonarQube's metricKey, projectKey and ruleKey values came back as REDACTED in proxied MCP results. The env-value scrub was innocent. Key names now fall into three classes. Names containing token, secret, password, passwd or credential, and names containing a strong word such as api, private, access, sign, ssh, hmac, pass, crypt, cipher, session, host or admin, are redacted unconditionally as before. A generic name ending in key is redacted only when its value is secret-shaped, 32 characters or more, or 16 or more with a digit, and an array or object under such a name is redacted whole when any element inside is secret-shaped or the span is truncated. Bare key keeps its 40-character floor. Two reviewer rounds: a 300000-case differential fuzz against main including container values found no case where this branch leaks something main redacted, every difference is a generic key with a non-secret value. Round one caught two real gaps in my first cut, containers under a generic key and missing strong words, both closed with tests. Regression test uses the real Sonar quality gate and issues response shapes. CHANGELOG Fixed bullet. 🤖 Generated with Claude Code
fix(executor): redact a generic *Key field only when its value is secret-shaped
All checks were successful
Lint / lint (pull_request) Successful in 1m8s
Details
Lint / sonarqube (pull_request) Has been skipped
Details
6e549a75af 
The scrubber treated any compound ending in key (metricKey, projectKey,
ruleKey, componentKey) as a credential name and redacted its value
whatever it held, so SonarQube quality-gate results proxied through
mcpproxy came back with every metric name replaced by [REDACTED] (#77).

Split the key class in two. Names containing token/secret/password/
passwd/credential, and names containing a credential word anywhere
(strongKeyRe: api, sign, hmac, pass, priv, crypt, ssh, host, session,
...), still redact by name alone. Any other ...key is a generic key whose
string or bare value is redacted only when secretShaped: 32+ characters,
or 16+ with a digit. An array or object under a generic key is redacted
whole when any string or bare token inside it is secret-shaped or the
span is truncated, and left intact otherwise. Bare key handling and
truncation behaviour are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pti merged commit 7850f6b4f3 into main 2026-10-19 23:13:29 +02:00
pti deleted branch fix/scrub-generic-key-shape 2026-10-19 23:13:29 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
pti/wraptool!104
No description provided.