Repository navigation
Follow the two password-literal allowlists to where 1.9.0's pins moved them - #174
Merged
Merged
Conversation
…d them The 1.9.0 release stopped at the secret scan: 9 hits per package, all from gemstone-password-literal, all text the allowlists already cover under paths the pin bumps moved. Grail #1716 moved the third-party packages it bundles, Django among them, from src/python/stdlib/ to src/python/bundled/ (7 hits: Django's password1_field_name="password1" and PASSWORD_FIELD = "password"). mcp_server 0.9.0 (#57) became a Rowan project, so its auth tests are now the Tonel package src/Mcp-Auth-Tests/ (2 hits: the throwaway user's 'swordfishXYZ'), which --no-auth still leaves out of the database with the rest of the Auth component. Run with gitleaks 8.30.1 over the 1.9.0 packages CI built for 58f85e3, main's config finds those 9 in each package and this one finds none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 1.9.0 Release run (39544258491) stopped at Secret scan. Each package had 9 hits, all from
gemstone-password-literal. Nothing was published: the scan runs before the GitHub Release and both registries.Cause
Every hit is text
.gitleaks.tomlalready allowlists, found under a path the 1.9.0 pin bumps moved:grail/src/python/stdlib/grail/src/python/bundled/django/contrib/auth/password1_field_name="password1",PASSWORD_FIELD = "password"mcp/src/auth/mcp/src/Mcp-Auth-Tests/'swordfishXYZ'Change
stdlib/andbundled/, since both carry third-party source verbatim.Mcp-Auth-Tests/. I checked mcp_server'sinstall.sh:--no-authstill leaves the Auth component, and so these tests, out of the database.Both allowlists stay scoped to this one rule, so a real key in those directories still fails the other rules. The comments record why each path moved.
Checked
I ran gitleaks 8.30.1, the version Release pins (checksum verified), over the three 1.9.0 packages CI built for 58f85e3, the same way the Release job does.
main's config gives 9 findings per package, matching the Release run. This config gives 0. Allowlists only remove findings, so this hides those 9 and nothing else.After merging
Release scans with the
.gitleaks.tomlfrom the commit being released, so 1.9.0 has to be released from this PR's merge commit. Wait for that commit's CI to go green, then run Release again.🤖 Generated with Claude Code