From 0abaa591fc10b91b70e5837d8d0434a32ee51dac Mon Sep 17 00:00:00 2001 From: pc Date: Thu, 12 Mar 2026 21:43:36 -0300 Subject: [PATCH] fix(security-review): redact secrets in evidence snippets to address Snyk W007 Add explicit instruction to never reproduce actual secret values (passwords, API keys, tokens) in code evidence. Require placeholders (e.g. [REDACTED]) so reports do not leak credentials. Updates output format template accordingly. --- plugins/sentry-skills/skills/security-review/SKILL.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/plugins/sentry-skills/skills/security-review/SKILL.md b/plugins/sentry-skills/skills/security-review/SKILL.md index 6a85366..51c1e52 100644 --- a/plugins/sentry-skills/skills/security-review/SKILL.md +++ b/plugins/sentry-skills/skills/security-review/SKILL.md @@ -242,6 +242,8 @@ random.random() for token # FLAG: Security tokens need secrets module ## Output Format +**Evidence and secrets:** When including code snippets as evidence, **never reproduce actual secret values** (passwords, API keys, tokens, private keys). Redact them with placeholders (e.g. `api_key = "sk-***REDACTED***"`, `password = "[REDACTED]"`) so the report does not leak credentials. + ```markdown ## Security Review: [File/Component Name] @@ -259,7 +261,7 @@ random.random() for token # FLAG: Security tokens need secrets module - **Impact**: [What an attacker could do] - **Evidence**: ```python - [Vulnerable code snippet] + [Vulnerable code snippet — redact any secret values; use placeholders] ``` - **Fix**: [How to remediate]