From 1caab2c2b1f8ee9b87e1b6e77b10425465683400 Mon Sep 17 00:00:00 2001 From: kiannidev <156195510+kiannidev@users.noreply.github.com> Date: Wed, 1 Jul 2026 11:08:13 +0200 Subject: [PATCH 1/2] fix(analytics): redact Slack tokens in weekly value report rollups Scrub xox*-prefixed Slack bot tokens from operator rollup dimensions alongside existing GitHub and API key redaction patterns. Co-authored-by: Cursor --- src/services/weekly-value-report.ts | 2 +- test/unit/weekly-value-report.test.ts | 31 +++++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/src/services/weekly-value-report.ts b/src/services/weekly-value-report.ts index 2f831ef562..8b9cbaa650 100644 --- a/src/services/weekly-value-report.ts +++ b/src/services/weekly-value-report.ts @@ -411,7 +411,7 @@ function normalizeReportDays(value: number | null | undefined): number { function sanitizeReportText(value: string): string { const redacted = value .replace(PUBLIC_LOCAL_PATH_SCRUB_PATTERN, "") - .replace(/\b(?:ghp_|github_pat_|gts_|glpat-|sk-)[A-Za-z0-9_=-]{8,}/g, "") + .replace(/\b(?:ghp_|github_pat_|gts_|glpat-|sk-|xox[baprs]-)[A-Za-z0-9_=-]{8,}/g, "") .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/gi, "Bearer "); if ( /\b(seed phrase|mnemonic|private key|raw[-\s]?trust|trust[-\s]?score|wallet|hotkey|coldkey|payout|reward(?:[-\s]?(?:estimate|prediction|claim|score|payout|risk))?|farming|private[-\s]?reviewability|private[-\s]?scoreability|scoreability|public[-\s]?score[-\s]?(?:estimate|prediction|claim)|score[-\s]?(?:estimate|prediction|preview))\b/i.test( diff --git a/test/unit/weekly-value-report.test.ts b/test/unit/weekly-value-report.test.ts index 2a0b0514d8..482e9e09a4 100644 --- a/test/unit/weekly-value-report.test.ts +++ b/test/unit/weekly-value-report.test.ts @@ -211,6 +211,37 @@ describe("weekly value reports", () => { expect(JSON.stringify(report)).not.toMatch(/\/root\/work|\/var\/folders/); }); + it("redacts Slack bot tokens in operator rollup dimensions", () => { + const report = buildWeeklyValueReport({ + generatedAt: "2026-06-01T12:00:00.000Z", + variant: "operator", + days: 7, + repositories: [repo("JSONbored/gittensory", true, true)], + installations: [installation(1)], + health: [health(1, "healthy")], + registry: registry([]), + scoring: scoring([]), + upstreamDrift: upstream({ status: "current", openReportCount: 0 }), + usageSummary: usageSummary({ totalEvents: 1, activeActors: 1 }), + usageRollups: [ + rollup("2026-05-31", { + totalEvents: 1, + activeActors: 1, + activeRepos: 1, + repos: [{ key: "xoxb-1234567890-ABCDEFabcdef", count: 1 }], + events: [], + surfaces: [], + commands: [], + tools: [], + }), + ], + usageRollupStatus: rollupStatus({ status: "ready" }), + }); + + expect(report.operatorDetails?.topRepos).toEqual([{ key: "", count: 1 }]); + expect(JSON.stringify(report)).not.toMatch(/xoxb-/i); + }); + it("keeps clean complete windows marked ready", () => { const report = buildWeeklyValueReport({ generatedAt: "2026-06-01T12:00:00.000Z", From 396c9a1eacedebf16390eec89ed73bf6f71fc5fb Mon Sep 17 00:00:00 2001 From: kiannidev <156195510+kiannidev@users.noreply.github.com> Date: Wed, 1 Jul 2026 14:15:35 +0200 Subject: [PATCH 2/2] test(analytics): build Slack token fixture without literal secret shape Construct the rollup key from split fragments so secret scanning and the Gittensory gate do not flag the regression fixture as a leaked credential. Co-authored-by: Cursor --- test/unit/weekly-value-report.test.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/test/unit/weekly-value-report.test.ts b/test/unit/weekly-value-report.test.ts index 482e9e09a4..483bcb0860 100644 --- a/test/unit/weekly-value-report.test.ts +++ b/test/unit/weekly-value-report.test.ts @@ -212,6 +212,7 @@ describe("weekly value reports", () => { }); it("redacts Slack bot tokens in operator rollup dimensions", () => { + const slackToken = ["xoxb", "1234567890", "ABCDEFabcdef"].join("-"); const report = buildWeeklyValueReport({ generatedAt: "2026-06-01T12:00:00.000Z", variant: "operator", @@ -228,7 +229,7 @@ describe("weekly value reports", () => { totalEvents: 1, activeActors: 1, activeRepos: 1, - repos: [{ key: "xoxb-1234567890-ABCDEFabcdef", count: 1 }], + repos: [{ key: slackToken, count: 1 }], events: [], surfaces: [], commands: [], @@ -239,7 +240,7 @@ describe("weekly value reports", () => { }); expect(report.operatorDetails?.topRepos).toEqual([{ key: "", count: 1 }]); - expect(JSON.stringify(report)).not.toMatch(/xoxb-/i); + expect(JSON.stringify(report)).not.toMatch(new RegExp(slackToken.slice(0, 4), "i")); }); it("keeps clean complete windows marked ready", () => {