Skip to content

v1.3.3 - CodeQL Compliance Hotfix

Choose a tag to compare

@ninadphalak ninadphalak released this 28 Aug 13:01
· 29 commits to main since this release
71f32de

This is a rapid follow-up patch to address a GitHub CodeQL Code Scanning Alert identified in v1.3.2.

What's Changed

🛡️ CodeQL md5 Suppression

In v1.3.2, we reverted from pbkdf2_hmac back to md5(usedforsecurity=False) for generating deterministic synthetic seed integers. While this drastically improved performance and satisfied standard Python Linters (Bandit/Ruff), GitHub CodeQL continued to flag the explicit presence of the md5 token as a High-Severity security risk (Rule: Use of a broken or weak cryptographic hashing algorithm on sensitive data).

  • Fix: Upgraded the deterministic seed generation to use the natively fast hashlib.sha256().hexdigest()[:16] instead.
  • Impact: This maintains the exact same microsecond-level speed as md5, keeps deterministic Fake data consistent, and successfully resolves the CodeQL alert without needing manual dismissals or PR overrides in the GitHub UI.

Validation

  • CodeQL: Addressed alert #17 in llm_shield_proxy/engines/vault.py
  • Pytest: 100% Pass (No regressions in deterministic vault mappings)

Full Changelog: v1.3.2...v1.3.3