Skip to content

v3.8.4 — Secrets stop reaching the log, and static analysis runs on every commit

Choose a tag to compare

View all tags
@bvisible bvisible released this 28 Aug 13:43
· 14 commits to main since this release
v3.8.4
f7e2b29

Security

The logger no longer writes secrets in clear text (CodeQL js/clear-text-logging).

logger.js serialised its structured data to JSON with no filter, into two places outside your control: ~/.ssh-manager.log and stderr, which your MCP host captures. One call site handing it a whole server config would have persisted a production password on disk, in two copies.

Redaction now happens inside the logger, not at each call site — any key matching password / passphrase / secret / token / credential / private_key / api_key / auth becomes [redacted], at any depth, inside arrays, whatever the casing. Cyclic objects are marked rather than followed, so a self-referencing config cannot hang a log call. Guarded by npm run test:redaction and verified by mutation.

No action needed — no configuration or API changes.

Added

  • CodeQL analysis on every push and pull request (security-and-quality). For a server that turns model output into shell commands on production hosts, "we read it carefully" is not an answer. Every fix in this release came out of its first run, and src/ now has zero open findings.

Changed

  • Every GitHub action pinned to a commit SHA, including trufflesecurity/trufflehog, which tracked the moving main branch inside a workflow with read access to the whole repository. Closes 17 of the 22 OpenSSF Scorecard findings.
  • Dependabot alerts and automated security fixes enabled — they were switched off.
  • The Release workflow is re-runnable: it skips publishing when the version is already on the registry, and creates the GitHub release if the SBOM step finds none.

Fixed

  • examples/backup-workflow.js never parsed — a cron expression (*/6) inside a /* */ block closed the comment early — and called createBackup(...), a function that exists nowhere. It was documentation of conversations with the agent, not a JavaScript API, and it shipped inside the npm tarball. It is now examples/backup-workflow.md.
  • scripts/validate.sh checks all 49 tracked .js files instead of only two, which is how the above stayed broken for months. The guard is itself verified by deliberately breaking a file.
  • Three time-of-check/time-of-use races in ssh-key-manager.js and config-loader.js.

Full changelog: https://github.com/bvisible/mcp-ssh-manager/blob/main/CHANGELOG.md#384---2026-08-28

Assets 3
Loading