Skip to content

jevnav v0.1.11

Choose a tag to compare

View all tags
@dtduc-git dtduc-git released this 21 Sep 16:08
· 12 commits to main since this release
v0.1.11
cdb8a03

jevnav 0.1.11 — the secret pattern catches concatenated names.

APIKEY, SECRETKEY, AUTHTOKEN, GITHUB_APIKEY and STRIPE_SECRETKEY all
slipped past the token-boundary pattern and would have landed verbatim in a
committed trace. A suffix branch catches them, while PASS and AUTH stay out
of it so BYPASS_CACHE and OAUTH_REDIRECT_URI do not match. The asymmetry is
deliberate: a missed secret is silent and worse than a false positive, which at
least warns.

ORDER_SPEC moved from page.py to trace.py next to SPEC — it is written
into the run header, and the lazy import it required is gone; page.py keeps a
pointer comment.

213 tests (212 pass, 1 skip).

Assets 2
Loading