From 1805afd46be37ec536cc265c450ade77524ab4bb Mon Sep 17 00:00:00 2001 From: kiannidev <156195510+kiannidev@users.noreply.github.com> Date: Fri, 26 Jun 2026 12:23:30 +0200 Subject: [PATCH] feat(signals): redact /var/ paths on the public-safety boundary Extend the canonical PUBLIC_UNSAFE_PATTERN so /var/ local paths are blocked on public GitHub surfaces alongside /root/ and /tmp/. Co-authored-by: Cursor --- src/signals/redaction.ts | 2 +- test/unit/redaction.test.ts | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/signals/redaction.ts b/src/signals/redaction.ts index d24e8f02e1..929f7e15d9 100644 --- a/src/signals/redaction.ts +++ b/src/signals/redaction.ts @@ -22,7 +22,7 @@ // intentionally NOT collapsed onto `PUBLIC_UNSAFE_TERMS`. export const PUBLIC_UNSAFE_TERMS = String.raw`(?:reward|score|wallet|hotkey|coldkey|mnemonic|payout|ranking)\w*|farming|raw[-_\s]?trust|trust[-_\s]?score|private[-_\s]?reviewability|reviewability`; -export const PUBLIC_UNSAFE_PATTERN = new RegExp(String.raw`\b(${PUBLIC_UNSAFE_TERMS})\b|/Users/|/home/|/root/|/tmp/|[A-Z]:[\\/]Users[\\/]`, "i"); +export const PUBLIC_UNSAFE_PATTERN = new RegExp(String.raw`\b(${PUBLIC_UNSAFE_TERMS})\b|/Users/|/home/|/root/|/var/|/tmp/|[A-Z]:[\\/]Users[\\/]`, "i"); /** True iff `text` contains nothing that must stay private — i.e. it is safe to surface on a public GitHub surface. */ export function isPublicSafeText(text: string): boolean { diff --git a/test/unit/redaction.test.ts b/test/unit/redaction.test.ts index 05c28e87cb..72efa0952b 100644 --- a/test/unit/redaction.test.ts +++ b/test/unit/redaction.test.ts @@ -40,6 +40,8 @@ describe("isPublicSafeText (#542 shared public/private boundary)", () => { expect(isPublicSafeText("/home/bob/repo")).toBe(false); expect(isPublicSafeText("/root/project/src")).toBe(false); expect(isPublicSafeText("clone failed at /root/work/repo")).toBe(false); + expect(isPublicSafeText("/var/log/app.log")).toBe(false); + expect(isPublicSafeText("/var/folders/alice/work/private-repo/cache.ts")).toBe(false); expect(isPublicSafeText("/tmp/scratch")).toBe(false); expect(isPublicSafeText("C:\\Users\\carol\\repo")).toBe(false); expect(isPublicSafeText("C:/Users/carol/repo")).toBe(false);