secrets.sh prints the credential it found #11

New Issue

Closed

opened 2026-08-17 22:59:54 -05:00 by null · 0 comments

null commented

2026-08-17 22:59:54 -05:00

Owner

secrets.sh reports a hit by printing the matching line truncated to 120 characters. That bounds how much of a long value reaches the terminal and does not redact anything: a credential shorter than the budget is printed whole, into the scrollback, the CI log, and wherever that log is shipped.

The comment above the report used to claim "the match is never echoed in full". It does not, and the comment was corrected in the same commit as --built rather than left overclaiming.

Reproduced: a fake JWT planted in a scratch build directory is echoed complete in the finding line.

This affects every mode, not only --built -- --tracked and the pre-commit --staged path print the same way, which means a real leak caught by the hook is also a real leak printed to a terminal.

The fix is to mask the matched span rather than truncate the line: capture the match with grep -o, replace it with a fixed marker in the reported line, and keep enough surrounding text that a person can find it. Keep the file and line prefix — the point is that somebody can go and look, not that they can read the value here.

Verify: a known credential planted in a scratch tree is reported with its file and line, and the value itself does not appear anywhere in the output of any mode.

`secrets.sh` reports a hit by printing the matching line truncated to 120 characters. That bounds how much of a long value reaches the terminal and does not redact anything: a credential shorter than the budget is printed whole, into the scrollback, the CI log, and wherever that log is shipped. The comment above the report used to claim "the match is never echoed in full". It does not, and the comment was corrected in the same commit as `--built` rather than left overclaiming. Reproduced: a fake JWT planted in a scratch build directory is echoed complete in the finding line. This affects every mode, not only `--built` -- `--tracked` and the pre-commit `--staged` path print the same way, which means a real leak caught by the hook is also a real leak printed to a terminal. The fix is to mask the matched span rather than truncate the line: capture the match with `grep -o`, replace it with a fixed marker in the reported line, and keep enough surrounding text that a person can find it. Keep the file and line prefix — the point is that somebody can go and look, not that they can read the value here. Verify: a known credential planted in a scratch tree is reported with its file and line, and the value itself does not appear anywhere in the output of any mode.