Skip to content

credential-patterns-v0.1.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jul 21:08
credential-patterns-v0.1.3
0045428
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

@opena2a/credential-patterns 0.1.3

  • CONFIG_FILES gains .mcp.json (Claude Code project-scope MCP config), .mcp/config.json, .claude/settings.local.json, .windsurf/mcp.json, and fixes the .curse/mcp.json → .cursor/mcp.json typo (Cursor's project MCP config was unreachable since the entry was introduced).
  • Database connection-string patterns (mongodb/postgres/mysql/redis) flag only URIs that embed a secret: userinfo password, password=/pwd=/sslpassword= param (case-insensitive), or — redis only — a single userinfo token (default@ carved out). Plain mongodb:// now covered. Matches cannot cross JSON string boundaries on minified content; all runs are length-bounded (220 KB adversarial input: ~30 ms, previously 11+ s quadratic).
  • CREDENTIAL_PREFIX_QUICK_CHECK derives redis from rediss? — the previous rediss prefix made consumers silently skip plain redis:// lines containing ${VAR}.

Consumers: secretless-ai 0.20.0 ships these; opena2a-cli picks them up at its next release (exact pin already bumped).

Verify provenance:

npm view @opena2a/credential-patterns@0.1.3 dist.attestations --json
Assets 2
Loading