Found by running the shipped v1.5.0 musl binary, not by review.
The anchored placeholder allowlist on secrets.generic-credentialed-url suppresses any password whose entire value decomposes into placeholder-vocabulary tokens. That is correct for changeme and your-db-password-here, but it also swallows weak-but-real credentials:
| value |
reported |
AdminPassword |
no |
SuperSecretKey |
no |
hunter2Passphrase |
no |
MyPassword123 |
yes |
CorpVpnPass2024 |
yes |
Tr0ub4dor3xample |
yes |
Xk29ZqTvBn7Lp |
yes |
Reproduce:
echo 'A=postgres://admin:AdminPassword@db.internal:5432/prod' > /tmp/u.txt
siloscan /tmp/u.txt
This is not the 1.4.0 substring-stopword defect — that one suppressed MyPassword123, which 1.5.0 reports correctly. This is the composed vocabulary in the anchored whole-value pattern being reachable by concatenation alone (admin+password, super+secret+key).
The tradeoff is deliberate and documented in the rule, and the fix is not obvious: requiring a digit or a separator would re-report a class of documentation URLs the current pattern was measured to suppress. Any change needs corpus coverage for the all-vocabulary shape first, measured before and after, so it does not repeat the 325 to 1222 finding regression.
Not a release blocker: the suppressed values are dictionary passwords, and every realistic credential shape tested is reported.
Found by running the shipped v1.5.0 musl binary, not by review.
The anchored placeholder allowlist on
secrets.generic-credentialed-urlsuppresses any password whose entire value decomposes into placeholder-vocabulary tokens. That is correct forchangemeandyour-db-password-here, but it also swallows weak-but-real credentials:AdminPasswordSuperSecretKeyhunter2PassphraseMyPassword123CorpVpnPass2024Tr0ub4dor3xampleXk29ZqTvBn7LpReproduce:
This is not the 1.4.0 substring-stopword defect — that one suppressed
MyPassword123, which 1.5.0 reports correctly. This is the composed vocabulary in the anchored whole-value pattern being reachable by concatenation alone (admin+password,super+secret+key).The tradeoff is deliberate and documented in the rule, and the fix is not obvious: requiring a digit or a separator would re-report a class of documentation URLs the current pattern was measured to suppress. Any change needs corpus coverage for the all-vocabulary shape first, measured before and after, so it does not repeat the 325 to 1222 finding regression.
Not a release blocker: the suppressed values are dictionary passwords, and every realistic credential shape tested is reported.