Skip to content

feat: add a bunch more secret patterns - #3872

Open
ellie wants to merge 1 commit into
mainfrom
more-secrets
Open

feat: add a bunch more secret patterns#3872
ellie wants to merge 1 commit into
mainfrom
more-secrets

Conversation

@ellie

@ellie ellie commented Aug 7, 2026

Copy link
Copy Markdown
Member

All of these secrets are invalid. Shush scanners and agents.

Checks

  • I am happy for maintainers to push small adjustments to this PR, to speed up the review cycle
  • I have checked that there are no existing pull requests for the same thing

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

@greptile-apps

greptile-apps Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

Adds secret-detection patterns and negative tests for commands that must remain in history.

  • Expands vendor token, credential URI, authorization header, Kubernetes, and environment-variable detection.
  • Broadens Slack webhook ID lengths.
  • Adds regression coverage for non-secret commands.

Confidence Score: 4/5

The ConfigMap false positive should be fixed before merging because it silently drops legitimate command history.

The default-enabled filter classifies every --from-literal command as secret-bearing even when Kubernetes uses it for a non-secret ConfigMap.

Files Needing Attention: crates/atuin-client/src/secrets.rs

Important Files Changed

Filename Overview
crates/atuin-client/src/secrets.rs The new patterns improve coverage, but the unscoped --from-literal regex also drops non-secret ConfigMap commands.

Reviews (1): Last reviewed commit: "feat: add a bunch more secret patterns" | Re-trigger Greptile

// `kubectl create secret generic … --from-literal=…` puts the secret value
// straight on the command line.
"Kubernetes secret literal",
r"--from-literal[= ]",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 ConfigMap literals lose history

When kubectl create configmap ... --from-literal=... is used, this unscoped pattern classifies the non-secret command as secret-bearing, causing it to be silently omitted from history and removed by history pruning.

Comment on lines +259 to +260
#[cfg(test)]
static NON_SECRETS: &[&str] = &[

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe move this into the tests module if it's only used by tests?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants