feat(scan): add confidence + remediation + fingerprint to secrets (rc-23v)#75
Open
Rome-1 wants to merge 1 commit into
Open
feat(scan): add confidence + remediation + fingerprint to secrets (rc-23v)#75Rome-1 wants to merge 1 commit into
Rome-1 wants to merge 1 commit into
Conversation
Collaborator
Author
Audit summary (rf-g6lr)Scope: strip internal repo references from anything public-visible, and verify the new scan-output fields actually pair with downstream consumers. 1. Internal repo references — cleanGrepped diff, PR description, commit message, full branch contents, and the worktree for any internal-repo name patterns. Zero matches. PR description rewritten to drop the "submitted out-of-band, not yet validated" caveat now that the work has been re-validated. 2. Downstream pairing — partialScanner emits Internal CLI consumers in this repo that do not pick the new fields up:
External consumers of the CLI's JSON live outside this repo and can adopt the new fields at their own pace — the additions are purely additive in the documented JSON shape. Filed follow-ups (out of scope for this PR):
Tests
|
…action
Extends `rafter scan` / `rafter secrets` finding output with fields the spec
already documents on the backend side but the local scanner didn't emit:
- pattern.confidence (high|medium|low) — how sure we are it's a real secret,
independent of pattern.severity (blast radius). High for unique-shape
prefixes (AKIA/ghp_/sk_live_), medium for entropy-gated Generic patterns,
low for Bearer/Generic Secret regex-only matches.
- remediation — per-pattern rotation/storage guidance. Cloud creds, API keys,
private keys, DB conn strings, JWT, bearer, and webhook each get tailored
text. All include "git history retains the secret — rotation is mandatory."
- fingerprint — 16-hex sha256(file + ruleName + redacted). Stable across
line-number drift; usable in .rafterignore via `fingerprint:<16hex>`.
- entropy filter — Generic API Key, Generic Secret, and Bearer patterns now
drop matches below Shannon entropy 3.5, eliminating low-entropy FPs like
"aaaaaaaaaaaa1".
Other changes:
- Gitleaks scanner uses our own fingerprint hash instead of slicing Gitleaks's
`<file>:<rule>:<line>` format, which leaked path data and wasn't a hash.
- SARIF output: rule.help.text carries remediation; rule.properties.confidence
and result.properties.{confidence,fingerprint} per finding.
- MCP `scan_secrets` tool returns the new fields.
- Hard-rule regression: tests assert raw secret values never appear in any
output surface (text, JSON, SARIF) for a planted shape-only fake.
Tests: 19 new in each of node/tests/secret-extraction.test.ts and
python/tests/test_secret_extraction.py. Existing 309 tests across both
implementations still pass.
Refs: rf-eyt (Build secret filtering and extraction into rafter scan).
Approval gated by rf-vzb (Rome).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Rome-1
force-pushed
the
polecat/garnet-mogldknn
branch
from
May 3, 2026 19:44
f6d2027 to
21167dd
Compare
Rome-1
marked this pull request as ready for review
May 3, 2026 19:45
Rome-1
added a commit
that referenced
this pull request
May 17, 2026
Maylist B6 asks for triage of Rome's comments across rafter-cli PRs. Sweep of the GitHub state turns up zero unaddressed asks: - 11 issue comments under Rome-1 identity are all agent status reports, not asks - 0 PR review comments - 33 reviews, all from the Raftersecurity org-bot - 5 open PRs: 2 are separate promo work, 2 are draft prompt-injection covered by sable-h6r, 1 (#75 rc-23v) is conflicting and already tracked by sable-xli The dispatcher's "Rome added comments to many other Rafter CLI PRs" most likely refers to the maylist itself (the 41 A/B items in hq-wisp-7zh), which is already beaded as A1-A29 / B1-B12. No follow-up beads required from this sweep. Audit doc: docs/audits/pr-comment-sweep-2026-05-17.md. Closes sable-9si.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bead: rc-23v
Adds
confidence,remediation, andfingerprintfields to secret extraction in the scan output, plus Shannon entropy filtering and.rafterignore fingerprint:<hash>suppression.Surfaces emitting the new fields: text, JSON, SARIF, MCP
scan_secrets. Spec updated inshared-docs/CLI_SPEC.md.Validation (post-audit, 2026-04-30):
python/tests/test_secret_extraction.py: 19/19 passnode/tests/secret-extraction.test.ts: 19/19 passconfidence+remediationon every entry.Known follow-ups (out of scope, tracked separately):
Internal CLI consumers (
issues/issue-builder.ts,report.ts,notify.ts) currently ignore the new fields. The GitHub-issue dedup format would need a back-compat migration before it can adopt the scanner fingerprint.Commit: