Skip to content

v1.2.1 — silent-suppression regex fix (mutation-probed)

Choose a tag to compare

View all tags
@tianzhicdev tianzhicdev released this 30 Aug 22:57
· 60 commits to main since this release
v1.2.1
be8ab87

Warning

Superseded engine tag — do not pin this version for scanning. Measured on this repo's own tags (author sweep, 30 legs): this generation reports damage as a FALSE CLEAN (rc 0) on at least one scan path — scan <FILE> blesses on every tag v1.1.0-v1.2.2; scan <subdir> inside a git repo blesses on v1.1.0-v1.2.1 (flat layouts can work by luck — only deep paths expose it); a nonexistent path exits 0 on v1.1.0-v1.2.2; and a genuine 40-char secret containing a literal 'xxx' run is silently dropped on v1.1.0-v1.2.0. Use v1.2.5 or newer (repoint at ship time): https://github.com/tianzhicdev/secretgate/releases/tag/v1.2.5 (all five legs measured red-then-green at v1.2.3+; re-pointed c91: v1.2.3/v1.2.4 each grew measured bless classes). If you consume the scanner through secretgate-action, pin the action tag (v1.2.6+) — action.yml + summarize.py ship signed together; never vendor one half. Evidence: agents/A/work/c84-engine-range/ (money repo).

Two word-boundary fixes to the scanner's SILENCE surfaces, both found by a seeded mutation probe (scripts/placeholder-mutation-matrix.py now runs in CI):

  • PLACEHOLDER_RE: 'xxx+' matched any 3-char x-run anywhere in a token — 9/7985 (0.11%) random 40-char base64 secrets were silently dropped from generic-api-key findings. Masking intent (standalone x-runs, >=5-char runs) stays suppressed; 19-fixture template vocab unchanged.
  • ALLOW_COMMENT_RE: 'nosec' was an unanchored substring — a line merely containing 'nosecret...' silenced every finding on it. Now \bnosec\b; explicit secretgate: allow unchanged.

Signed receipt (secretgate-v1.2.1-proof.md) verifies with ethkey-lite: python3 ethkey.py verify secretgate-v1.2.1-proof.md --require 0xFD4090e27C1f946Ff01a265cAa7d4ACA662acC15.
All positives (receipts, allow-pragma examples, existing CI) verify identical — additive strictness, zero consumer repoints required.

ALSO WARNING (c85, added 2026-08-31): this gen ALSO silently blesses any secret whose VALUE contains an embedded dictionary word (insert/example/your/changeme/dummy/redacted/placeholder/test-) anywhere — raw-substring arms in PLACEHOLDER_RE, both generic-keyword and entropy-sweep paths. Measured non-vacuous; fixed in v1.2.4 (token-start anchoring, templates stay suppressed, 0 blast-radius on fleet bytes). Pin v1.2.5 or newer (repoint at ship time). (v1.2.4 still carries the measured mid-token 5-x-run bless class, see next paragraph)

ALSO WARNING (c86, added 2026-08-31): this gen ALSO silently blesses any secret whose VALUE contains a literal 5-x run mid-token (e.g. a 40-hex key with 'xxxxx' embedded) — bare unanchored x{5,} arm in PLACEHOLDER_RE, both paths (stranger-measured, C c81 x5_midrun). v1.2.5 bounds it to token-END runs (masking intent); mid-token embeds are now FLAGGED. Pin v1.2.5 or newer (repoint at ship time).

C91 POINTER FIX (2026-08-31, c91 banner-coverage R5): present-tense pin pointers on this page re-pointed at v1.2.5 — the previous pointers (v1.2.3/v1.2.4) were accurate when written and decayed as new bless classes landed on those gens (pointer-decay law, C c86). No tag or asset moved.

C95 P3 HEDGE (2026-08-31, c95): present-tense directives on this page carry a forward hedge — 'or newer' keeps them correct when the next tag ships (P3-cell decay test: simulated next-ship scored 16 unhedged directives red; hedged corpus scores 0). No tag or asset moved.

Assets 3
Loading