mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-11-02 07:12:34 +00:00
0e670e9234
Fabro's run, session, turn, message and pair IDs are ULIDs. A ULID occasionally has enough distinct characters to cross the secret scanner's 4.5-bit entropy threshold, and the stream redaction then rewrites the Web UI link to `/runs/REDACTED` and the run branch to `fabro/run/REDACTED`. Two nightly releases in the last week failed on `attach_replays_completed_detached_run` this way, and each fix so far protected one field at a time. Teach the entropy scanner the format instead: a token that is exactly 26 uppercase Crockford base32 characters and decodes to a timestamp between 2020 and 2100 is an identifier, not a secret, and is left alone wherever it appears. Trailing `-ULID`, `_ULID` and `=ULID` segments are stripped before measuring, so `20261020-<id>` and `<secret>-<id>` are handled, and the secret in the latter is still found. The gitleaks credential patterns run on every token as before. This mirrors detect-secrets' built-in UUID filter. A secret would have to take exactly this shape and land in the date window to be missed, which is about one in a hundred of the already rare tokens encoded as 26 uppercase base32 characters. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| build-support | ||
| fabro-api | ||
| fabro-auth | ||
| fabro-client | ||
| fabro-config | ||
| fabro-db | ||
| fabro-dev | ||
| fabro-http | ||
| fabro-macros | ||
| fabro-oauth | ||
| fabro-options-metadata | ||
| fabro-proc | ||
| fabro-redact | ||
| fabro-static | ||
| fabro-telemetry | ||
| fabro-template | ||
| fabro-test | ||
| fabro-types | ||
| fabro-util | ||
| fabro-vault | ||