v0.12.30

v0.12.30 — a vendor API key is no longer sent in part when another rule matches inside it

With --llm-anonymize, an API key could be split and partly sent to the model endpoint when its random body happened to contain something another masking rule recognises first: a short sk- key shape after a -, a fragment of another vendor's key, an AWS access key id, a private host suffix such as .lan, a JWT, a UUID or a home directory. The vendor-key rule then masked only the part on one side, and the rest went out in the clear. This happened mostly on the line's template, for a few keys in every ten thousand. The fail-closed re-scan read the remainder as clean. Stripe, GitHub, Slack and Google keys were affected since v0.12.15; the formats added in v0.12.29 and the AWS secret access key in v0.12.29 only. Twilio SIDs were never affected.

This fixes a credential leak. It was handled as a private security advisory: GHSA-8qq6-vx8j-rx37.

Found while working on #116.

What changed:

• The vendor-key and AWS-secret rules still run last, but each also reads the line once more, on its own. Wherever an earlier rule left part of a key unmasked, the whole key now becomes one placeholder.
• The same change closes a rarer case in v0.12.29: an AWS secret key sent whole after an access key id longer than a real one.
• No masking rule changed or moved.

Measured:

• 5,484,900 generated keys across every format, placement and escape: 582,379 were split in v0.12.29, none in v0.12.30.
• With the new pass switched off, the code matches v0.12.29 byte for byte; a test requires that every byte v0.12.29 masked is still masked.
• Wire check against a capturing endpoint: v0.12.29 sends key text on 16 of 17 test lines, v0.12.30 on none.
• 10 real journald boots: nothing changes. Masking costs 18–29% more per escalation; it runs once per escalation, not per log line.

Costs, pinned in the tests:

• A value that overlapped a split key, such as a host label, now goes into the key's placeholder.
• A handful of generated lines that v0.12.29 sent with part of a key are now refused whole instead.

Install: download the binary for your OS from the assets below, or go install github.com/maxie7/logscry/cmd/logscry@latest.

Known limitations:

• No new ones from this change. The full list is in the README's Known limitations.

Tracked as GHSA-8qq6-vx8j-rx37.