Repository navigation
fix(cbio): keep masked auth vectors out of key-shaped string form - #148
Closed
shroominic wants to merge 2 commits into
Closed
shroominic wants to merge 2 commits into
shroominic wants to merge 2 commits into
Conversation
The Secret Scan gate fails on this lane with one gitleaks `generic-api-key` finding in `packages/cgm_cbio/test/cbio_crypto_test.dart`. The value is a published synthetic masking vector, but it is a 50-character high-entropy string assigned to a name containing "auth", which is exactly the shape the detector is built to catch. The five masking vectors are now byte lists. The vectors and the assertions are unchanged; `dart test` still passes 60 tests, and the same package tree now reports no leaks to gitleaks 8.24.3.
shroominic
added a commit
that referenced
this pull request
Sep 18, 2026
Absorbs feature/cbio-gs1-app-live at 05785b0, which carries the redacted credential API (#166 verbatim as a7c21bc) and the live lane's adoption of an injected CbioCredentialSource (PR #192, issue #191). Conflict resolution: - packages/cgm_cbio/README.md: union. The aggregate's FF31 reply-decode paragraph (#132) and the lane's new injected-material section are both kept; neither lineage had the other. - packages/cgm_cbio/test/cbio_crypto_test.dart: take the lane's version. It supersedes the masked-vector fixture from #148 by removing the published vectors entirely and testing the mask with synthetic material.
Owner
Author
|
Superseded at the consolidated tip, not carried verbatim: the fixture this PR re-encodes no longer exists. The GS1 line replaced it with obviously synthetic bytes plus an injected credential source, so no tip publishes or compiles vendor material, and the 48-character binding survives only in history. The Secret Scan gate is green on the consolidation head (#209, feature/cbio-gs1) through the repository scanning policy absorbed there. Closing as superseded by a stronger change. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #147. Base is
feature/cbio-gs1-glucose-live.Gate
Security / Secret Scanis red onfeature/cbio-gs1-glucose-live(#136) with onegeneric-api-keyfinding, so the lane and both sensor aggregates carry a failing security gate.The flagged value is a published masking vector stored as a 50-character hex string. It is not a credential by name, but it is worse than a false positive: it is the masked form of a frame whose plaintext is published next to it, so it is a function of the vendor stream key.
Change
The five masking vectors are byte lists instead of hex strings. Nothing else moves: the same vectors, the same five assertions, the same coverage.
The comment that used to sit above them claimed the byte-list form keeps the vectors "without tripping that detector". That framing is wrong and has been replaced: re-encoding is not a security control, it does not make the values harmless, and it must not be a template for handling key-derived data.
Superseded
fix/cbio-credential-redaction(#166) removes the published vectors from the tip and tests masking with synthetic material instead. That is the fix that actually holds; this change only stops the fixture from being the reason the gate is red while #166 is open, and it should be dropped if #166 lands first.Verification
gitleaks detect --no-git --source packages/cgm_cbio --redact --exit-code=2(gitleaks 8.24.3, default ruleset)no leaks foundon this tipgeneric-api-keyfinding