Skip to content

Extend secret-redaction patterns (GitHub PAT, Slack, Google API keys) #57

Description

@alphacrack

Summary

Extend the secret-redaction patterns in the filter layer to cover a few common token formats not currently caught (e.g. GitHub fine-grained PATs github_pat_, Slack tokens xox[baprs]-, Google API keys AIza...), so they're redacted before IaC is sent to the LLM.

Where

src/iac_scanner/scanners/_filters.py — the secret-redaction regexes (currently AWS keys, RSA/EC private keys, bearer/PAT patterns).

What to do

  • Add regexes for the additional token shapes.
  • Add unit tests in tests/test_filters.py asserting each new pattern is redacted and that non-secret lookalikes are not over-redacted (watch false positives).

Acceptance criteria

  • New patterns redact real tokens.
  • Tests cover both positive (redacted) and negative (untouched) cases.
  • No regression in existing test_filters.py.

Good first issue notes

Self-contained, security-relevant, with a clear test target. Be conservative with regexes — a false positive that mangles legitimate config is worse than a miss. See SECURITY.md for the threat model.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:scannersTerraform / CDK scanners, filters, skip-listgood first issueScoped, well-understood, low prerequisite — pick this uphelp wantedMaintainers welcome a PR heretype:securitySecurity-relevant defect or hardening

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions