fix(protect-secrets): close the grep and Grep-tool .env bypasses - #48
Merged
Conversation
Two ways an agent read .env past the guard, both found while recording a demo: - Bash grep/rg/awk/etc. on .env slipped past the cat-only patterns. New grep-env critical pattern covers the text-search tools, and the pattern skips over quoted strings so a pipe inside grep -E "A|B" .env cannot break the separator guard. - The built-in Grep tool was never inspected. It is now normalized to a Read against its path/glob/include target and runs through the same file-path check, denying with a search-flavored message. .env.example and ordinary source-tree greps stay allowed. 14 regression tests added, including the on-camera command shapes and a documented residual (pattern-only Grep with no path). guard-pack lib copy kept byte-identical. Suite 1584/0. Fixes #47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #47.
Two ways an agent read
.envpastprotect-secrets, both surfaced while recording demos for the CodeSecCon talk. The failed takes are the proof of concept; this is the fix plus regression tests.What was wrong
cat-envonly coveredcat/less/head/tail/more/bat/view.grep -E "STRIPE_API_VERSION|STRIPE_SECRET_KEY" .envread the file cleanly. A pipe inside the quoted pattern also defeats a plain[^|;&]*separator guard.Greptool. Not registered at all, soGrep(pattern=..., path=".env")was never inspected.The fix
grep-envcritical Bash pattern forgrep/rg/egrep/fgrep/ag/awk/gawktargeting.env. The middle of the pattern skips over single- and double-quoted strings, so a|inside quotes no longer breaks the separator guard while a real shell separator still stops the match (a followingcat .envis left tocat-env).Grepadded to the accepted tool list and normalized to aReadagainst itspath/glob/includetarget, so it flows through the existingcheckFilePathlogic and denies with a search-flavored message.Scope kept tight
.env.exampleand ordinary source-tree greps stay allowed (existing allowlist covers them; tests assert it).Grepwith no path searches the whole tree and can still surface a secret line. Blocking that would break normal search; the honest mitigation is output-side, not pattern matching. Called out in a test and a comment rather than papered over.Tests
14 new regression tests (both bypass groups, the on-camera command shapes, the quoted-pipe variant, and the documented residual). Full suite 1584 pass / 0 fail. guard-pack
lib/copy kept byte-identical (drift test passes).