Fix: Close verification gate review findings

2026-08-27 00:21:45 -04:00
parent 77f625d7bb
commit 12b858371e
10 changed files with 575 additions and 57 deletions
@@ -29,7 +29,8 @@ note() { findings+=("$1"); }
 scanner="$repo_dir/tests/server/scan-tracked-secrets.py"
 fixtures_dir="$repo_dir/tests/server/fixtures/secrets"

-if ! python3 "$scanner" "$fixtures_dir/clean" compose.yml .env.example README.md; then
+if ! python3 "$scanner" "$fixtures_dir/clean" \
+    compose.yml .env.example README.md signature-near-misses.txt; then
    note 'the clean secret-scanning fixture was rejected'
 fi

@@ -53,6 +54,10 @@ expect_leak .env.example '.env.example:1: API_TOKEN'
 expect_leak plain-list.yml 'plain-list.yml:4: API_TOKEN'
 expect_leak quoted-mapping.yml 'quoted-mapping.yml:4: API_TOKEN'
 expect_leak quoted-list.yml 'quoted-list.yml:4: API_TOKEN'
+expect_leak pem-private-key.txt 'pem-private-key.txt:1: private key'
+expect_leak anthropic-token.txt 'anthropic-token.txt:1: provider token'
+expect_leak github-token.txt 'github-token.txt:1: provider token'
+expect_leak slack-token.txt 'slack-token.txt:1: provider token'

 mapfile -t tracked_server_files < <(git -C "$repo_dir" ls-files 'server/**' 'server/*')
 if ! output="$(python3 "$scanner" "$repo_dir" "${tracked_server_files[@]}" 2>&1)"; then
@@ -0,0 +1,4 @@
+-----BEGIN SYNTHETIC PUBLIC KEY-----
+sk-ant-
+ghp_0123456789ABCDEFGHI
+xoxb-
@@ -0,0 +1 @@
+sk-ant-SYNTHETIC_FIXTURE_TOKEN
@@ -0,0 +1 @@
+ghp_0123456789ABCDEFGHIJ
@@ -0,0 +1 @@
+-----BEGIN SYNTHETIC PRIVATE KEY-----
@@ -0,0 +1 @@
+xoxb-SYNTHETIC_FIXTURE_TOKEN