cli: detect source maps, keys, and htpasswd as sensitive

Author: AnttiJalomaki

crates/opencodecommit/src/context.rs

@@ -90,6 +90,21 @@ static SENSITIVE_FILE_PATTERNS: LazyLock<Vec<regex::Regex>> = LazyLock::new(|| {
         r"(?:^|/)secrets?\.\w+$",
         r"(?:^|/)\.netrc$",
         r"(?:^|/)service[-_]?account.*\.json$",
+        // Source maps — can expose full unminified source code
+        r"\.(?:js|css)\.map$",
+        r"(?:^|/)[^/]+\.map$",
+        // Private keys and certificates
+        r"\.pem$",
+        r"\.p12$",
+        r"\.pfx$",
+        r"\.key$",
+        r"\.keystore$",
+        r"\.jks$",
+        // SSH private keys (not .pub)
+        r"(?:^|/)id_(?:rsa|ed25519|ecdsa|dsa)$",
+        r"(?:^|/)\.ssh/",
+        // Auth files
+        r"(?:^|/)\.htpasswd$",
     ]
     .iter()
     .map(|p| regex::Regex::new(p).unwrap())
@@ -449,6 +464,33 @@ mod tests {
         assert!(!detect_sensitive_content(diff, &["app.ts".to_owned()]));
     }
 
+    #[test]
+    fn detects_source_map_files() {
+        assert!(detect_sensitive_content("diff", &["bundle.js.map".to_owned()]));
+        assert!(detect_sensitive_content("diff", &["styles.css.map".to_owned()]));
+        assert!(detect_sensitive_content("diff", &["dist/app.map".to_owned()]));
+    }
+
+    #[test]
+    fn detects_private_key_files() {
+        assert!(detect_sensitive_content("diff", &["server.pem".to_owned()]));
+        assert!(detect_sensitive_content("diff", &["cert.p12".to_owned()]));
+        assert!(detect_sensitive_content("diff", &["ssl.key".to_owned()]));
+        assert!(detect_sensitive_content("diff", &["app.keystore".to_owned()]));
+    }
+
+    #[test]
+    fn detects_ssh_private_keys() {
+        assert!(detect_sensitive_content("diff", &["id_rsa".to_owned()]));
+        assert!(detect_sensitive_content("diff", &["id_ed25519".to_owned()]));
+        assert!(detect_sensitive_content("diff", &[".ssh/config".to_owned()]));
+    }
+
+    #[test]
+    fn detects_htpasswd() {
+        assert!(detect_sensitive_content("diff", &[".htpasswd".to_owned()]));
+    }
+
     // --- skip patterns ---
 
     #[test]

extension/src/inline/context.ts

@@ -53,6 +53,21 @@ const SENSITIVE_FILE_PATTERNS = [
   /(?:^|\/)secrets?\.\w+$/,
   /(?:^|\/)\.netrc$/,
   /(?:^|\/)service[-_]?account.*\.json$/,
+  // Source maps — can expose full unminified source code
+  /\.(?:js|css)\.map$/,
+  /(?:^|\/)[^/]+\.map$/,
+  // Private keys and certificates
+  /\.pem$/,
+  /\.p12$/,
+  /\.pfx$/,
+  /\.key$/,
+  /\.keystore$/,
+  /\.jks$/,
+  // SSH private keys (not .pub)
+  /(?:^|\/)id_(?:rsa|ed25519|ecdsa|dsa)$/,
+  /(?:^|\/)\.ssh\//,
+  // Auth files
+  /(?:^|\/)\.htpasswd$/,
 ]
 
 const SENSITIVE_LINE_PATTERNS = [

extension/src/test/inline.test.ts

@@ -526,6 +526,29 @@ describe("detectSensitiveContent", () => {
     const diff = `+  const result = await fetchData()`
     assert.strictEqual(detectSensitiveContent(diff, ["app.ts"]), false)
   })
+
+  it("detects source map files", () => {
+    assert.strictEqual(detectSensitiveContent("diff", ["bundle.js.map"]), true)
+    assert.strictEqual(detectSensitiveContent("diff", ["styles.css.map"]), true)
+    assert.strictEqual(detectSensitiveContent("diff", ["dist/app.map"]), true)
+  })
+
+  it("detects private key files", () => {
+    assert.strictEqual(detectSensitiveContent("diff", ["server.pem"]), true)
+    assert.strictEqual(detectSensitiveContent("diff", ["cert.p12"]), true)
+    assert.strictEqual(detectSensitiveContent("diff", ["ssl.key"]), true)
+    assert.strictEqual(detectSensitiveContent("diff", ["app.keystore"]), true)
+  })
+
+  it("detects SSH private keys", () => {
+    assert.strictEqual(detectSensitiveContent("diff", ["id_rsa"]), true)
+    assert.strictEqual(detectSensitiveContent("diff", ["id_ed25519"]), true)
+    assert.strictEqual(detectSensitiveContent("diff", [".ssh/config"]), true)
+  })
+
+  it("detects htpasswd", () => {
+    assert.strictEqual(detectSensitiveContent("diff", [".htpasswd"]), true)
+  })
 })
 
 // --- buildBranchPrompt ---