docs(#6499): add credential-redaction invariant to Go contributing guide - #6500
Open
fullsend-ai-coder[bot] wants to merge 1 commit into
Open
docs(#6499): add credential-redaction invariant to Go contributing guide#6500fullsend-ai-coder[bot] wants to merge 1 commit into
fullsend-ai-coder[bot] wants to merge 1 commit into
Conversation
Add a "Security: credential redaction for external content" section to docs/contributing/go-code.md documenting four invariants for runner features that process external content (validation output, CI logs, script stdout/stderr) before injecting it into LLM prompts, logging, or file storage: 1. Scan RunnerEnv for credential literal values, replacing with [REDACTED:<key>] via sensitiveEnvKey classification, skipping values shorter than minRedactableSecretLen (8) 2. Apply security.SecretRedactor pattern scan as second-pass fallback for credentials not in RunnerEnv 3. Use truncateUTF8 (not byte slicing) for size limits to avoid splitting multi-byte runes 4. Write files containing potential secrets with mode 0600 Reference redactFeedback in internal/cli/run.go as the canonical implementation pattern. Cross-reference #2107 (replicate existing security patterns) and #2872 (post-script security invariants). Update the AGENTS.md topic index to mention credential redaction so agents discover the guidance when reading for Go changes. Note: pre-commit could not run (sandbox network policy blocks git fetch for hook environment setup). Manual review confirms markdown formatting follows existing conventions. Closes #6499
Site previewPreview: https://fb2dadcd-site.fullsend-ai.workers.dev Commit: |
|
🤖 Finished Review · ✅ Success · Started 9:59 PM UTC · Completed 10:13 PM UTC Commit: |
ReviewFindingsMedium
Low
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| | File | When to read | | ||
| |------|-------------| | ||
| | [Go Code](docs/contributing/go-code.md) | Changing Go code under `cmd/` or `internal/` — covers mint sync, coverage, vet, e2e tests, concurrency testing, suite-timeout policy, WASM binary size constraints, and preferring `go run` for the CLI | | ||
| | [Go Code](docs/contributing/go-code.md) | Changing Go code under `cmd/` or `internal/` — covers mint sync, coverage, vet, e2e tests, concurrency testing, suite-timeout policy, WASM binary size constraints, credential redaction for external content, and preferring `go run` for the CLI | |
There was a problem hiding this comment.
[medium] protected-path
This PR modifies AGENTS.md, which is a protected governance file. The PR links to issue #6499 which explicitly authorizes the table entry update, and the PR body explains the rationale. Human approval is always required for protected-path changes, regardless of context.
|
|
||
| When multiple code paths produce errors for the same condition across different forges or providers, ensure they mention the same remediation options. For example, if one "no token found" error suggests both the environment variable and the `--token` flag, other forge-specific token errors should do the same — so users see consistent guidance regardless of which code path triggers. | ||
|
|
||
| ## Security: credential redaction for external content |
There was a problem hiding this comment.
[low] pattern-inconsistency
The new section heading '## Security: credential redaction for external content' uses a colon-separated Category: subtitle pattern that no other ## heading in this file uses. Existing headings are plain noun phrases or gerund phrases.
Suggested fix: Rephrase to match the existing noun-phrase style, e.g., '## Credential redaction for external content'.
fullsend-ai-review
Bot
added
the
requires-manual-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/contributing/go-code.mddocumenting four invariants for runner features processing external content:RunnerEnvliteral scan withsensitiveEnvKeyclassification,security.SecretRedactorpattern fallback, rune-safetruncateUTF8for size limits, and0600file permissionsredactFeedbackininternal/cli/run.goas the canonical implementation pattern, and cross-reference Code agent should replicate existing security patterns when adding similar logic to a file #2107 and Post-scripts: document security invariants so code and review agents maintain them #2872 for related guidance in other layersContext
Retro finding from PR #6495 (
feedback_modefor the validation loop). The code agent's original implementation passed validation output raw — no credential redaction, permissive file permissions, and naive byte-slice truncation. The human reviewer force-pushed amendments addingredactFeedback,sensitiveEnvKey,minRedactableSecretLen,truncateUTF8, and restrictive permissions. This guidance ensures future runner features follow the established security pattern.Testing
Documentation-only change — no Go production code modified. Verified:
redactFeedbackis referenced as the canonical patternCloses #6499
Post-script verification
agent/6499-credential-redaction-docs)7015bfd31f5553401462c9cdcaa1816a3dda1942..HEAD)