From 28b55967ae6da6c2b294cfec94f57c77c074c165 Mon Sep 17 00:00:00 2001 From: Zongwei9888 Date: Thu, 6 Aug 2026 17:46:20 +0800 Subject: [PATCH] fix(security): allowlist the #131 test fixture in gitleaks history MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Secret history scan has failed on main since dd8f0a8. Cause: merging #131 with -s ours recorded the branch in history without applying its tree, and gitleaks scans history, not the working tree. The finding is a fixture, not a credential — the literal "sk-secret123456" inside a RuntimeError message, asserting that error text is redacted before it reaches the UI. Its file, tests/ui_session_resume_test.py, does not exist on main, so the finding cannot be fixed by editing it; a fingerprint entry is the only route. Verified: gitleaks over origin/main now reports no leaks across 240 commits. Note for future -s ours merges: they bring the branch's full history under the secret scan. Two branches deliberately left unmerged (#133, #143) carry findings of their own, and #133's is a real key — merging them for attribution alone would have put it in main's history permanently. Co-Authored-By: Claude Opus 5 (1M context) --- .gitleaksignore | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitleaksignore b/.gitleaksignore index c2ff053a..0e1589c2 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -5,3 +5,10 @@ b2dccbe6d37e74e98b8a57593c1a5bb4994fba59:mcp_agent.secrets.yaml:generic-api-key:9 420d07580e83885cdf784115131aea884e704a8f:mcp_agent.secrets.yaml:generic-api-key:2 225e344437173185f22f30cbac58fc82f9fbe3ed:mcp_agent.secrets.yaml:generic-api-key:2 + +# Test fixture, not a credential: the literal "sk-secret123456" inside a +# RuntimeError message, used to assert that error text is redacted before it +# reaches the UI. It arrived with the #131 merge, which recorded the branch in +# history without applying its tree — so the file does not exist on main and +# the finding cannot be fixed by editing it. +6421db9a2fb04589200f8883f950a329b7ced1cd:tests/ui_session_resume_test.py:generic-api-key:87