fix(gating): harden directory scans and fail closed without SLM - #118
Conversation
|
Warning Review limit reachedNext included review available in 48 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 37502491 | Triggered | Generic Password | d33ab22 | src/oracle/src/lib.rs | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Removes a test-only password-shaped literal introduced by PR #118. The runtime-assembled fixture preserves coverage while preventing GitGuardian from reporting a false positive. This branch is based directly on the merged main commit so the security scanner does not re-process the historical commit that introduced the fixture. Local verification: `cargo test -p policy-oracle --lib --locked`. Co-authored-by: Arena Agent <agent@arena.ai>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| let root = std::env::temp_dir().join(format!("conative-scan-{}", Uuid::new_v4())); | ||
| fs::create_dir_all(&root).unwrap(); | ||
| let file = root.join("notes.txt"); | ||
| fs::write(&file, r#"password = "not-a-real-secret-123""#).unwrap(); |
2 participants
Summary
Foundational follow-up hardening after the dependency issue was resolved. This makes the CLI and oracle behavior match their documented safety contract.
Changes
Directory scanning
--include-hidden,--depth,--include, and--excludefunctional instead of silently ignored.SLM safety
ModelNotLoaded/InferenceError.Tests
Verification
cargo fmt --all -- --checkRUSTFLAGS=-Dwarnings cargo check --workspace --lockedRUSTFLAGS=-Dwarnings cargo clippy --workspace --locked -- -D warningscargo test --workspace --lockedcargo build --release --workspace --lockedcargo audit --deny warningscargo audit --deny unmaintainedAll local checks pass.