fix(network): preserve detections in README environment files

[mldangelo-oai]

Summary

• Treat README.env, readme.env, README.ENV, and README.md.env as executable environment files instead of trusted README documentation.
• Preserve both network_library and network_function findings at detector and TextScanner layers while keeping legitimate README image examples informational.
• Document the user-visible scanner correction under [Unreleased].

Validation

• Confirmed both detector and TextScanner regressions fail on current main before the fix.
• PROMPTFOO_DISABLE_TELEMETRY=1 python -m pytest tests/detectors/test_network_comm_detector.py tests/scanners/test_text_scanner.py -q --maxfail=1: 1,299 passed.
• Ruff lint and format checks, changed-file Python 3.13 mypy, and CHANGELOG Prettier check passed.
• Three independent exact-head Codex security reviews and fresh verification completed without findings.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 24f9de7fb0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 13 shared benchmarks with a regression threshold of 15%.
Status: 0 regressions, 0 improved, 13 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 4.205s -> 4.223s (+0.4%).

Workload	Benchmark	Target	Size	Files	Baseline	Current	Change	Status
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_raw]	nested_raw	78 B	1	244.1us	235.9us	-3.3%	stable
direct-malicious-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_direct_malicious_upload	malicious_reduce	52 B	1	192.8us	188.3us	-2.3%	stable
duplicate-heavy-registry	tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_registry_snapshot	registry-snapshot	915.2 KiB	13	576.93ms	586.52ms	+1.7%	stable
padded-multi-stream-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_padded_multi_stream_upload	multi_stream_padded	4.1 KiB	1	291.4us	294.4us	+1.0%	stable
clean-training-checkpoint	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_clean_training_checkpoint	safe_large	278.2 KiB	1	113.63ms	114.28ms	+0.6%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_base64]	nested_base64	98 B	1	253.5us	254.9us	+0.5%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_hex]	nested_hex	130 B	1	263.4us	264.8us	+0.5%	stable
single-checkpoint-preflight	tests/benchmarks/test_scan_benchmarks.py::test_scan_single_checkpoint_before_load	single_checkpoint.pkl	183.0 KiB	1	105.50ms	105.90ms	+0.4%	stable
chunked-upload-stream	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_chunked_upload_stream	chunked_stream	278.2 KiB	1	116.64ms	117.00ms	+0.3%	stable
mixed-model-repository	tests/benchmarks/test_scan_benchmarks.py::test_scan_release_candidate_repository	release-candidate	547.3 KiB	32	617.01ms	618.66ms	+0.3%	stable
rejected-basic-auth-candidates	tests/benchmarks/test_scan_benchmarks.py::test_rejected_basic_auth_candidates_scan_linearly	-	371.1 KiB	1	2.389s	2.395s	+0.2%	stable
warm-cache-rescan	tests/benchmarks/test_scan_benchmarks.py::test_scan_warm_cached_repository_rescan	release-candidate	547.3 KiB	32	138.74ms	138.44ms	-0.2%	stable
suspicious-pickle-intake	tests/benchmarks/test_scan_benchmarks.py::test_scan_suspicious_pickle_intake	suspicious-intake	183.8 KiB	4	146.42ms	146.56ms	+0.1%	stable

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 24f9de7fb0

View security finding report

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[Copilot]

Pull request overview

This PR fixes a network-communication detection regression where README-named environment files (e.g., README.env, README.md.env) were being treated like trusted README documentation for the “official sample image” exception, which could suppress actionable network_library / network_function findings. The change tightens the README image-example context logic so only true README documentation extensions get the exception, and adds regression tests to lock the behavior in.

Changes:

• Remove .env from the README “official sample image” allowlist context so README-named env files remain actionable for network detections.
• Add detector- and TextScanner-level regression tests ensuring network_library and network_function findings are preserved for README*.env filenames.
• Document the user-visible fix in the root changelog under [Unreleased].

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
modelaudit/detectors/network_comm.py	Stops treating readme.*.env as a trusted README image-example context so network findings aren’t suppressed.
tests/detectors/test_network_comm_detector.py	Adds regression coverage that README*.env contexts preserve network_library/network_function findings.
tests/scanners/test_text_scanner.py	Adds end-to-end TextScanner regression coverage for README*.env filenames preserving network findings.
CHANGELOG.md	Notes the fix under [Unreleased] bug fixes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.