Repository navigation
fix(redact): mask Stripe secret and restricted keys - #3037
Merged
Merged
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
@kevin9327 is attempting to deploy a commit to the SupaMaus Team on Vercel. A member of the Team first needs to authorize it. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title is concise, specific, and accurately describes the primary change: masking Stripe secret and restricted keys. |
| Description check | |
The description explains what changed, why it changed, and how it was verified. It omits the template checklist and uses a "Tests" heading instead of "How it was verified," but it provides the require… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Description check
-
Explanation
The description explains what changed, why it changed, and how it was verified. It omits the template checklist and uses a "Tests" heading instead of "How it was verified," but it provides the required verification details and is mostly complete.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files.
✨ Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Contributor
Author
|
The three failing vitest shards (ShareTeamDialog "1 playbooks", file-size-ratchet, chat-dir-auto TaskPicker) fail identically on main at 62a7b7a (CI run 39072696208), so they are pre-existing and unrelated to the redact change. |
z4mbo
added a commit
to z4mbo/Origin
that referenced
this pull request
Oct 18, 2026
Adapt the Stripe secret/restricted prefix pattern from milind-soni#3037, merge 170a58b. Preserve publishable keys, short examples and stable length-only markers. The identical regression selection fails five/passes22 before the fix and passes all27 afterward, including a documented isolated fake-provider turn through the real native log writer. Consumer and guard checks pass194 with nine existing Windows skips; client/server types and focused lint pass. Co-authored-by: Codex <noreply@openai.com>
jencryzthers
added a commit
to pulsatrixtechnologies/Sagax
that referenced
this pull request
Oct 19, 2026
…, session Claude retirée après échec d'auth, clés Stripe) (#778) ## Résumé Ports sélectifs des correctifs de sécurité du projet amont OpenMausBot, classés « Sécurité » dans l'audit du 2026-10-18 (lot `secu-memoire`). Réécrits chez nous, aucun cherry-pick, rien de `enterprise/`. - **port de OpenMausBot milind-soni#2856** : la mémoire d'équipe (`server/team-memory.ts`) était la seule mémoire écrite par un bot sans masquage. Chaque entrée passe par `redactSecretsInText` avant d'être enregistrée ou montrée ; en plus de l'amont, une entrée déjà enregistrée par une version précédente est masquée au chargement et le fichier est réécrit. La suppression d'un bot appelle `memoryUpkeep.forgetBot` dans le gestionnaire `bot.deleted` (tous les chemins de suppression) : tours en attente, lots différés et état d'entretien partent, et une capture encore en vol n'écrit plus rien pour un bot disparu. - **port de OpenMausBot milind-soni#2867** : un tour Claude réglé en `auth_required` retire le processus du pool, comme `update_required`. Un CLI resté vivant à réessayer son rafraîchissement OAuth partagé bloquait les autres bots Claude. - **port de OpenMausBot milind-soni#3037** (postérieur à l'audit, 3 lignes) : masquage des clés Stripe `sk_live_`, `sk_test_`, `rk_live_` (l'ancien motif ne couvrait que `sk-`), y compris coupées par « … ». Non portés, avec raison : - milind-soni#2707 (garde du corps de `request-sign-in`) : la fonctionnalité n'existe pas chez nous. - milind-soni#2708 (approbation de lecture des apps connectées) : recoupe les règles d'approbation des membres, en refonte par un autre agent (worktree sagax-member-terminal). - milind-soni#2756 (plancher de sécurité, 3k lignes) : à décider par JC (lot 11 de l'audit). ## Licence Parties d'origine sous Apache 2.0 (LICENSE-APACHE, NOTICE déjà à jour) ; nos adaptations sous PolyForm NC. Chaque port dit « port de OpenMausBot #NNNN » en texte. ## Vérification - Tests ajoutés : `team-memory.test.ts` (masquage à l'écriture et au chargement), `memory-upkeep.test.ts` (bot supprimé oublié), `redact.test.ts` (Stripe), `drivers/claude.test.ts` (le processus du CLI meurt après `auth_required` ; échoue sans le correctif, passe avec). - `team-memory`, `redact`, `memory-upkeep` : 78/78. `claude.test.ts` : vert sauf « pays the cold start at process boot » (minutage < 300 ms, charge machine 369), sans lien. - `pnpm lint`, `pnpm typecheck` verts. Valeurs de test manifestement fausses. - Relecture de sécurité indépendante : aucun bloquant ; ses 2 importants (test qui ne vérifiait rien, entrées déjà enregistrées non masquées) et 2 mineurs (forgetBot sur tous les chemins, préfixes Stripe coupés) sont corrigés dans le 2e commit. ## Notes de version - FR : Sécurité : les secrets sont masqués dans la mémoire d'équipe (y compris les entrées déjà enregistrées), un bot supprimé ne laisse plus d'état d'entretien de mémoire, une session Claude dont l'authentification a échoué est fermée au lieu de bloquer les autres bots, et les clés Stripe sont masquées. - EN: Security: secrets are masked in team memory (including entries already saved), a deleted bot leaves no memory upkeep state behind, a Claude session whose sign-in failed is closed instead of blocking other bots, and Stripe keys are masked. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Jean-Christophe Proulx <jencryzthers@Jean-Christophes-Macbook-Pro.local> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
shared/redact.tsgains a key-prefix pattern for Stripe secret and restricted keys (sk_live_,sk_test_,rk_live_,rk_test_), soredactSecretsInTextmasks them andholdsCredentialrecognises them.Base commit:
62a7b7ac72e4f0adae1b373032592df7327d7b26.Why
The
sk-pattern is commented "anthropic / openai / stripe", but it only matches the hyphenated forms (sk-live-…). Real Stripe keys use underscores —sk_live_51H…,rk_live_…— so none of the existing patterns match them:A Stripe key pasted into a chat, a tool title or an MCP
argslist therefore reached the protocol log and activity chips in the clear (onlyKEY=…-style assignments caught it, by name). The new pattern requires the fullsk_live_/sk_test_/rk_…prefix plus 16+ alphanumerics, keeping with the file's high-precision rule.Tests
server/redact.test.ts: three Stripe cases in "masks known key prefixes wherever they appear" and one in theholdsCredentialpositive list (assembled at runtime like the others, to stay clear of push protection).expected 'stripe sk_live_abcdef…' not to match /sk_live_[a-z]/, andholdsCredentialreturns false.server/redact.test.ts22/22;vitest run shared server/decision-log.test.ts server/admin-activity.test.ts34 files / 488 tests pass. Linux only.AI assistance: this change was prepared with an AI coding assistant and reviewed and tested by me.
Summary by CodeRabbit