Repository navigation
feat: credentials-only redaction and open public egress (contract 1.15) - #19
Conversation
…s (contract 1.15) Part of tinyhumansai/openhuman#7328. Co-authored-by: Medulla <medulla@tinyhumans.ai>
Tiny Sweeper reviewTiny Sweeper reviewed this change across 5 lane(s) and found 1 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. State: Changes requested Review snapshot
Completeness: Complete FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. Findings
Before merge
How this fits togetherflowchart LR
n0["as_str"]:::impacted
n1["config"]:::impacted
n2["append"]:::impacted
n3["batch"]:::impacted
n4["..._sink_and_returns_original_distinct_scope"]:::impacted
n5["...t_callback_without_changing_trusted_scope"]:::impacted
n4 -->|calls| n0
n4 -->|uses| n0
n4 -->|tests| n0
n5 -->|uses| n0
n5 -->|calls| n1
n5 -->|tests| n1
n5 -->|calls| n2
n5 -->|tests| n2
n5 -->|calls| n3
n5 -->|tests| n3
classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing: 18
✨ Finishing Touches
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 03562232a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| || (request.local_capability.is_none() | ||
| && self | ||
| .policy | ||
| .preflight_transports | ||
| .contains(&request.transport)) |
There was a problem hiding this comment.
When a policy opts into Browser or Proxy, this condition grants the request after the module's DNS lookup even though those executors resolve the hostname again and need not use the vetted sockets. An attacker who changes DNS after preflight can therefore direct the protected request to a private or metadata address. The checked accepted specification explicitly requires an enforcing proxy or denial for transports that cannot pin (docs/specs/security-module.md:133-140), and the implementation plan repeats that requirement (docs/plans/security-module.md:143-145); permitting the risk here contradicts those current invariants rather than providing protected egress.
AGENTS.md reference: AGENTS.md:L162-L166
Useful? React with 👍 / 👎.
| if value.len() < 8 || value.chars().any(char::is_whitespace) { | ||
| return false; |
There was a problem hiding this comment.
For common JSON-shaped output such as {"Authorization":"Bearer opaque-token-123"}, the optional bearer scheme is not captured in label because it is inside the quotes, while value contains whitespace and is rejected here as non-secret. The entire credential is consequently returned unchanged, despite the contract in MODULE.md:343-350 specifically promising to remove Authorization: Bearer ... values from free-form tool output. Recognize bearer/basic schemes inside quoted values rather than treating all whitespace-containing values as source code.
AGENTS.md reference: AGENTS.md:L162-L163
Useful? React with 👍 / 👎.
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
Requesting changes: 1 lane(s) blocking, worst finding is critical.
Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.
$0.0100 · 1,793,506 in / 58,497 out · 345,088 cached (19%) · ladder/vectors-oai3, deepseek-v4.1-flash · 775 embedded
critique: $0.0010 · 889,139 in / 11,726 out · 168,704 cached (19%) · deepseek-v4.1-flash
security: $0.0086 · 737,005 in / 42,867 out · 162,944 cached (22%) · deepseek-v4.1-flash
tests: $0.0001 · 91,363 in / 890 out · 6,912 cached (8%) · deepseek-v4.1-flash
description: $0.0001 · 62,755 in / 826 out · 6,528 cached (10%) · deepseek-v4.1-flash
| assert!(out.contains("[REDACTED]"), "{secret} -> {out}"); | ||
| for leaked in [ | ||
| "abcdefghijklmnop1234", | ||
| "AKIAIOSFODNN7EXAMPLE", |
There was a problem hiding this comment.
Remove the committed credential (an AWS access key id)
Rotate the credential first, then remove it from the working tree and purge it from history. Treat it as compromised: it is in the push, whatever happens next.
Matched: AKIA… <redacted, 20 chars>
[RULE] aws-access-key-id ·
1 participant
Part of tinyhumansai/openhuman#7328 (phase 3).
Unblocks the host's remaining phase 3 moves.
RedactMode::CredentialsOnly: registry, provider token shapes, JWT, PEM, cookie headers and labelled credential-looking values; keeps PII and source-code-looking values (token = get_token()), so the host's tool-result scrub can use the module (the #6954 over-redaction case). Credential rotation is the existing policy Reinit.EgressPolicy.open_public: any http/https destination, address floor and privacy checks unchanged.EgressPolicy.preflight_transports(browser, proxy): verdict-only grants for executors that cannot pin; never for local capabilities. Both fields skipped on the wire when unset.Verified locally: fmt, clippy 1.99 -D warnings, workspace tests. The 90% per-file gate runs in CI (local llvm-cov toolchain mismatch).