Stop the secret sweep failing on a clean tree (relay#53) #121

2026-09-05T01:36:33Z

paulhitt commented

2026-09-05 01:36:33 +00:00

(Migrated from gitlab.com)

token: "deadbeef" — an attachment id in a truncation test — trips the
"assigned password" pattern, and has on main for a while. I hit it
publishing relay#50 and had to stop and prove the match was pre-existing
before I could trust my own branch.

A gate that fails on a clean tree is worse than no gate. It teaches you
to run it and ignore the answer, and the one time it catches something real
the habit is already to shrug.

The two obvious fixes are both worse. Narrowing the pattern until
deadbeef slips through puts a hole in the SHAPE — the next real secret that
happens to be lowercase goes with it. Allow-listing the value silences
deadbeef everywhere, including a file where it is real.

So: a per-line // secret-sweep: fixture marker, and nothing else. It must be
typed at the site by somebody who looked at the line, and it is greppable.

The count is pinned, because a printed number is not a gate. Nobody
reads the output of a passing check, so "suppressions are counted" would have
been decoration — somebody could mark a real credential as a fixture and this
would say clean in green. EXPECTED_FIXTURES makes adding a marker FAIL
until the number is bumped in the same change: a second, deliberate act, in a
diff a human is already reading.

Proved all four ways rather than just the first, which is what the ticket
asked for:

clean tree → clean (190 files, 1 fixture)
planted sk_live_ with no marker → FAILED, Stripe live key
planted sk_live_ WITH a marker → FAILED, 2 markers, expected 1,
and it prints the offending line
plant removed → clean again

659 tests in 60 suites pass.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

`token: "deadbeef"` — an attachment id in a truncation test — trips the "assigned password" pattern, and has on `main` for a while. I hit it publishing relay#50 and had to stop and prove the match was pre-existing before I could trust my own branch. **A gate that fails on a clean tree is worse than no gate.** It teaches you to run it and ignore the answer, and the one time it catches something real the habit is already to shrug. **The two obvious fixes are both worse.** Narrowing the pattern until `deadbeef` slips through puts a hole in the SHAPE — the next real secret that happens to be lowercase goes with it. Allow-listing the value silences `deadbeef` everywhere, including a file where it is real. So: a per-line `// secret-sweep: fixture` marker, and nothing else. It must be typed at the site by somebody who looked at the line, and it is greppable. **The count is pinned, because a printed number is not a gate.** Nobody reads the output of a passing check, so "suppressions are counted" would have been decoration — somebody could mark a real credential as a fixture and this would say `clean` in green. `EXPECTED_FIXTURES` makes adding a marker FAIL until the number is bumped in the same change: a second, deliberate act, in a diff a human is already reading. Proved all four ways rather than just the first, which is what the ticket asked for: clean tree → clean (190 files, 1 fixture) planted sk_live_ with no marker → FAILED, Stripe live key planted sk_live_ WITH a marker → FAILED, 2 markers, expected 1, and it prints the offending line plant removed → clean again 659 tests in 60 suites pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

paulhitt commented

2026-09-05 01:36:33 +00:00

(Migrated from gitlab.com)

assigned to @paulhitt

paulhitt (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2026-09-05 01:36:48 +00:00

paulhitt commented

2026-09-05 20:17:42 +00:00

(Migrated from gitlab.com)

mentioned in merge request !68

paulhitt commented

2026-09-07 11:50:41 +00:00

(Migrated from gitlab.com)

aborted the automatic merge because the source branch was updated. Learn more.

aborted the automatic merge because the source branch was updated. [Learn more](https://gitlab.com/help/ci/pipelines/merge_trains.md#merge-request-dropped-from-the-merge-train).

paulhitt commented

2026-09-07 11:50:42 +00:00

(Migrated from gitlab.com)

added 39 commits

fb5696f4...13ffce9a - 38 commits from branch main
ffdbef88 - Stop the secret sweep failing on a clean tree (relay#53)

Compare with previous version

added 39 commits <ul><li>fb5696f4...13ffce9a - 38 commits from branch <code>main</code></li><li>ffdbef88 - Stop the secret sweep failing on a clean tree (relay#53)</li></ul> [Compare with previous version](/paulhitt/flamenet-relay/-/merge_requests/58/diffs?diff_id=2008949924&start_sha=fb5696f488f22c2d2aba7141c3a1a16b9478ea71)

paulhitt commented

2026-09-07 13:13:24 +00:00

(Migrated from gitlab.com)

mentioned in commit 7e1792f638

mentioned in commit 7e1792f638750b1249c5aec790e5d3f77db6886c

paulhitt (Migrated from gitlab.com) merged commit 7e1792f638 into main

2026-09-07 13:13:24 +00:00

paulhitt commented

2026-09-09 18:58:56 +00:00

(Migrated from gitlab.com)

changed the description

paulhitt commented

2026-09-24 18:09:32 +00:00

(Migrated from gitlab.com)

mentioned in merge request !160

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#121