v0.10.0

Fixes a password leak in nested values and detects more credentials and identifiers. A run that passed before can now redact, review or block, so re-check your policies before upgrading a gate.

If you use 0.9.0 or earlier: in values nested like {"...password":{"value":"..."}}, such as Spring Actuator dumps, only the opening brace was redacted and the password stayed in the output. Check any output you shared from logs of this shape, and rotate those credentials if needed.

Install

python -m pip install ciphergate-cli

Added

• ssn_pattern detector for dashed US Social Security numbers (pii.government_id). They were labelled pii.phone, so government-ID rules did not apply, and a strict template can now block.

Fixed

• secret_pattern no longer stops at { for nested values.
• secret_pattern now finds camelCase password names, Cookie and Set-Cookie headers, and session and CSRF cookie values. luhn_card finds labelled CVV and CVC values.
• Fewer false alarms: shell PWD paths, code such as settings.X or request.Y on the right of an assignment, and an HTTP status followed by a byte count.

Known limits

Names, addresses and usernames in free text are still missed without other measures, and rescan can pass with them present. See docs/detector-coverage.md. Review output before sharing it.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

Verify the download

sha256sum -c SHA256SUMS

Full changelog: v0.9.0...v0.10.0