Add credential rotation runbook and CI secret scan (refs #22) - #120

Open

paccloud wants to merge 17 commits into

mainfrom

claude/repo-audit-improvement-ozhlau

Commits on Sep 29, 2026

chore(security): owner rotation runbook and CI secret scan (refs #22)
claude
committed
b730775
test: use a global regex for the lone-CR fixture (fixes CodeQL alert)
claude
committed
67342ab
fix(security): close scanner bypasses and stage the Neon rotation (refs #22)
claude
committed
d14ff3a
fix(security): make the scanner fail closed and close four more bypasses
claude
committed
a57121b
fix(security): fix six more scanner gaps by class, scan the staged blob, cap test time
claude
committed
b42c83a
fix(security): remove an exponentially backtracking path regex (CodeQL js/redos)
claude
committed
d1d33e3
fix(security): scan lockfiles, PR commit ranges, XML config and more token families
claude
committed
d915c7a
fix(security): keep pair context in range scans, compare index before size skip
claude
committed
7df222a
fix(security): close four more scanner gaps (indented pipes, unmerged modes, markers, curl -u)
claude
committed
ab14804
fix(security): read fish/shell set forms, multiline literals, skip binaries in range
claude
committed
42d1f30
docs(security): limit file-type claim to scanned files, add rollback caveat
claude
committed
9e80e71
fix(security): flag punctuated XML passphrases, keep range context in characters
claude
committed
27d428e
fix(security): logical assignment ops, YAML block pairs, quoted SQL, heredoc passphrases
claude
committed
d7bcaea
fix(security): scan auth headers, terraform variable labels, redis-style directives
claude
committed
b789e76
fix(security): scan merge results, quoted basic-auth passphrases, lockfile PEM history
claude
committed
b055207
fix(security): properties whitespace keys, variable refs, env setters; harden CodeQL sites
claude
committed
1df880a
fix(security): drop JS hashing of file/match text, compare in memory
claude
committed
e404ef7

Navigation Menu

Add credential rotation runbook and CI secret scan (refs #22) - #120

Add credential rotation runbook and CI secret scan (refs #22)#120
paccloud wants to merge 17 commits into
mainfrom
claude/repo-audit-improvement-ozhlau

Commits on Sep 29, 2026

chore(security): owner rotation runbook and CI secret scan (refs #22)

test: use a global regex for the lone-CR fixture (fixes CodeQL alert)

fix(security): close scanner bypasses and stage the Neon rotation (refs #22)

fix(security): make the scanner fail closed and close four more bypasses

fix(security): fix six more scanner gaps by class, scan the staged blob, cap test time

fix(security): remove an exponentially backtracking path regex (CodeQL js/redos)

fix(security): scan lockfiles, PR commit ranges, XML config and more token families

fix(security): keep pair context in range scans, compare index before size skip

fix(security): close four more scanner gaps (indented pipes, unmerged modes, markers, curl -u)

fix(security): read fish/shell set forms, multiline literals, skip binaries in range

docs(security): limit file-type claim to scanned files, add rollback caveat

fix(security): flag punctuated XML passphrases, keep range context in characters

fix(security): logical assignment ops, YAML block pairs, quoted SQL, heredoc passphrases

fix(security): scan auth headers, terraform variable labels, redis-style directives

fix(security): scan merge results, quoted basic-auth passphrases, lockfile PEM history

fix(security): properties whitespace keys, variable refs, env setters; harden CodeQL sites

fix(security): drop JS hashing of file/match text, compare in memory