Summary
Extend the secret-redaction patterns in the filter layer to cover a few common token formats not currently caught (e.g. GitHub fine-grained PATs github_pat_, Slack tokens xox[baprs]-, Google API keys AIza...), so they're redacted before IaC is sent to the LLM.
Where
src/iac_scanner/scanners/_filters.py — the secret-redaction regexes (currently AWS keys, RSA/EC private keys, bearer/PAT patterns).
What to do
- Add regexes for the additional token shapes.
- Add unit tests in
tests/test_filters.py asserting each new pattern is redacted and that non-secret lookalikes are not over-redacted (watch false positives).
Acceptance criteria
Good first issue notes
Self-contained, security-relevant, with a clear test target. Be conservative with regexes — a false positive that mangles legitimate config is worse than a miss. See SECURITY.md for the threat model.
Summary
Extend the secret-redaction patterns in the filter layer to cover a few common token formats not currently caught (e.g. GitHub fine-grained PATs
github_pat_, Slack tokensxox[baprs]-, Google API keysAIza...), so they're redacted before IaC is sent to the LLM.Where
src/iac_scanner/scanners/_filters.py— the secret-redaction regexes (currently AWS keys, RSA/EC private keys, bearer/PAT patterns).What to do
tests/test_filters.pyasserting each new pattern is redacted and that non-secret lookalikes are not over-redacted (watch false positives).Acceptance criteria
test_filters.py.Good first issue notes
Self-contained, security-relevant, with a clear test target. Be conservative with regexes — a false positive that mangles legitimate config is worse than a miss. See SECURITY.md for the threat model.