Repository navigation
Detection par la forme : retrait de la deny-list en clair - #1
Merged
Merged
Conversation
The tool meant to prevent a client name from leaking had become the leak: .github/scripts/check_client_leak.py listed the whole client portfolio in plaintext, in a public repository. Self-exemption fixed self-detection, not exposure. - scripts/check_no_client_leak.py: byte-identical copy of the frozen canonical scanner (Fab-Analyze-Data-Agent@6e4a65e, 4023 bytes). Never edited; every adaptation is applied from the wrapper. - .gitattributes pins that one file to LF so core.autocrlf cannot silently break the published checksum on a Windows checkout. - scripts/check_repo_leaks.py: CI entry point. Re-allows this repo structural GUID placeholders at runtime, and restores name detection from the CLIENT_DENYLIST secret (or a gitignored .clientdeny). No secret means a warning and success, never a failure. Findings report file:line only, since a public repo Actions log would otherwise re-publish what it is guarding. - Colour tolerance is generalised to any entry and recognised by shape (CSS declaration, hex code, badge URL) instead of hardcoding a name to exempt it. - tests/test_leak_scanner.py: 17 tests. Every fixture is assembled at runtime from opaque sentinels; no real GUID, endpoint or name is ever written down. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remplace la deny-list de noms en clair par une detection par la forme.
Pourquoi
Le garde-fou anti-fuite embarquait la liste des noms a proteger, en clair, dans un fichier
suivi par git. Sur un depot public, cela publie exactement ce qu'il devait masquer.
Ce qui change
CLIENT_DENYLIST(secret GitHub Actions) ou un fichier.clientdenygitignore.chemin utilisateur personnel. Une regle morphologique ne peut pas redevenir une fuite.
.gitattributesfixeeol=lfsur le scanner partage, sinon un checkout Windowsreecrit le fichier en CRLF et invalide son empreinte publiee.
Verifications