Skip to content

Add an AGENTS.md section covering sensitive information #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
petrutlucian94 merged 1 commit into from
Sep 23, 2026
Merged

Add an AGENTS.md section covering sensitive information #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 32 additions & 2 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@
were stored.
- `docs/probing_samples` contains examples of scripts that were used for
reverse engineering purposes. The goal is to provide a better insight over
the reverse engineering procedure. Sanitize any sensitive information such
as credentials and ips.
the reverse engineering procedure. Those scripts, like all other committed
files, must follow the Sensitive information rules below.


## Architecture
Expand All @@ -53,6 +53,36 @@
(`tox -e stress`).


## Sensitive information

Lab topology and credentials live only in gitignored `.test_config.yaml`.
Do not copy live values from it (or from ssh, vim, tcpdump, strace, or
sslhook output) into anything that will be committed.

Sanitize before committing. This applies to `README.md` sample YAML,
`docs/`, `docs/probing_samples/`, comments, tests, and log excerpts — not
only probing scripts. Strip or replace:

- IPs and hostnames (vCenter, ESXi, HotAdd proxy, iSCSI portal)
- Usernames, passwords, SSH identity paths, and home directories
(e.g. `/home/ubuntu/...`)
- VM / datastore names that are unique to the lab, morefs, SSL
thumbprints, session tokens, and NAA / WWN identifiers of lab LUNs
- Pickle files, sslhook logs, strace dumps, and packet captures (keep
those under `/tmp`; they contain lab host and credentials)

Use placeholders that match existing docs:

- Hostnames: `vcenter.example.com`, `hotadd-proxy.example.com`
- IPs: RFC 5737 documentation addresses (`192.0.2.0/24`) or `<vcenter>` /
`<esxi>`
- ConnectEx fields and tickets: `<sanitized>` (see `vddk_san_trace.py`)
- Sample passwords: generic `secret`, not a lab password

README / `docs/*.md` YAML is a template, not a dump of `.test_config.yaml`.
Before finishing a docs or sample-config change, grep the diff for RFC1918
addresses, `/home/`, and values that appear in `.test_config.yaml`.

## Other rules

- AI agents should ignore folders that start with a dot, e.g. .mypy_cache, .ruff_cache, .tox
Expand Down
Loading