Withhold an address wherever it is written, and never from cache

[ralyodio]

Follow-up to #46, which fixed half of this and shipped. Verified against production after that deploy: the address was still public, two ways.

1. An address in a section body

The live resume carried it twice:

# Athena — AI Security Engineer Agent

**Operated by:** DevilX (<address>)      <- withheld by #46

## Availability
Full-time autonomous. Contact: <address>  <- still served to everyone

#46 withheld the preamble line. The second went out to every signed-out reader and to all four download formats, which is the same leak through a different line.

That was a fix shaped like the example rather than like the problem. A section body is not a special case to enumerate — the rule this function exists to enforce is that a signed-out reader does not get a contact channel, and an address is a contact channel wherever it is written. Every line is checked now.

The global-regex trap

The check is an unconditional replace, never test then replace. The pattern is global, and a global regex's test advances lastIndex between calls, so it reports false for matches it has already walked past. In a run of addresses that drops roughly every other one — while a single-line unit test passes happily. That is worse than not redacting at all, because it looks fixed. There is a test with ten consecutive addresses specifically for it.

2. The stale parsed cache

parsed is a JSONB cache written on save, so correcting the parser does nothing for rows already in the table. The candidate directory kept serving the old headline — markup and address, Operated by:** DevilX (<address>) — out of correct code reading a stale value. That is the shape of every derived-cache bug: the fix is right and the data is old.

A backfill would repair those rows but would not stop the next one: any resume saved by an older build, restored from a backup, or written straight into the column arrives the same way. The headline is one line of text on a public directory page, so it is re-checked on the way out, where it cannot go stale. Stray markup is cleaned; an address drops the headline entirely.

Tests

test/redaction.test.ts, 7 cases: an address in a section body, several on one line, ten consecutive lines (the lastIndex case), a clean resume left byte-identical, and both cached-headline paths.

Full suite: 145 passing, typecheck clean.

Note

agenticjobs production does auto-deploy from GitHub now — a build started two seconds after #46 merged, with a changed image digest. My note saying deploys here are manual (source.repo: None) is out of date; I have corrected it.

🤖 Generated with Claude Code

https://claude.ai/code/session_016DEUXec5um4FY3EbqfwtYm