Add detection dispositions, typed role surrogates, and a sentinel - #12
Merged
greenseeing merged 1 commit intoAug 25, 2026
Merged
Conversation
Land three related pieces of the detection/redaction plan together; they share the Kind enum, the scrub sweep, and shapes.py, so they don't split cleanly. D0 (#2) — three-tier disposition model. Every rule/Match/Finding now carries a disposition. SCRUB rewrites (a GitHub PAT becomes a shape-preserving random look-alike, never a readable or reversible alias); WARN flags but leaves in place (a Twilio SK 32-hex key, too collision-prone to auto-scrub, surfaces as a review warn row with a line number); a public identifier that only shares a shape (Stripe pk_) gets no rule. An explicit scrub decision — a promotion, an --also, or a review override — outranks WARN, so a keyword-confirmed secret is never scrubbed in one place and left verbatim in another. --strict still gates on the warn rows. R2 (#4) — --also-host / --also-person / --also-project type a declared value's surrogate as host-a / person-b / project-c via a new roles channel on LocalIdentity and new Kind.PERSON / Kind.PROJECT; casing collapses to one. R3 (#5) — minted secret surrogates carry a self-advertising sentinel and the sweep keeps any value already exactly equal to its own alias, so a second scrub pass is a fixed point (no re-scrub, no re-warn) for readable counters, secret randoms, emails and documentation IPs — including the redacted-a self-collision. The skip binds to the actual minted alias, so an ordinary compound that merely looks like a surrogate label (user-alice) still gets its declared value scrubbed. The IPv4 documentation pool (762 addresses) now warns on overflow instead of silently wrapping two addresses onto one alias. Also fix a pre-existing quadratic ReDoS in the email rule: an unbounded local part rescanned the whole remaining run at every start position looking for an @, O(n^2) on a large dump. Bounding it to RFC 5321's 64 octets makes the scan linear; a long adversarial input now completes in well under a second. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
greenseeing
deleted the
feat/detection-disposition-and-typed-surrogates
branch
August 25, 2026 21:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lands three related pieces of the detection/redaction plan together (they share the
Kindenum, the scrub sweep, andshapes.py, so they don't split cleanly).What changed
Match/Finding. GitHub PAT → SCRUB (shape-preserving random look-alike); TwilioSK32-hex → WARN row with a line number; Stripepk_public identifier → left unchanged. An explicit scrub decision (promotion,--also, or a review override) outranks WARN.--strictstill gates on warn rows.--also-host/--also-person/--also-projecttype a declared value's surrogate ashost-a/person-b/project-c(newroleschannel onLocalIdentity, newKind.PERSON/Kind.PROJECT); casing collapses to one surrogate.redacted-aself-collision. The skip binds to the actual minted alias, so an ordinary compound that merely looks like a surrogate label (user-alice) still gets its declared value scrubbed. The IPv4 documentation pool (762 addresses) warns on overflow instead of silently wrapping.Also
Verification
scrubbrCLI and thescrub()seam. Reviewed by code-quality-reviewer; a CRITICAL (compound-word leak) and HIGH (WARN outranking explicit scrub) were fixed with regression tests.Closes #2
Closes #4
Closes #5
🤖 Generated with Claude Code