Skip to content

security: extend credential redaction to mysql -p<password> and PG* env-var idioms #1287

Description

@sahrizvi

Summary

#1246 closed a specific credential leak in ledger text: curl -u <user> <password> (space-separated) surviving redactLedgerDetail/maskString and getting persisted into a model prompt across session compaction. The fix is correct and well-tested for that exact idiom, but scoped narrowly to USER_FLAG_RE (curl-specific -u/--user) plus generic name=value / --flag=value / colon-shaped patterns.

Two sibling credential idioms in the same risk class are not caught by the current catalog in packages/opencode/src/session/compaction.ts:

  1. MySQL client unseparated flag+value: mysql -psecret / mysqldump -uroot -psecret — no =, no space, no colon between flag and value. Neither USER_FLAG_RE nor the generic patterns match this shape.
  2. Env-var-assigned credentials with no separator character before the sensitive name: PGPASSWORD=secret psql ... is not flagged as sensitive because SENSITIVE_NAME's boundary requirement ((?:^|[_-])password(?:$|[_-])) requires a _/- immediately before "password" — PGPASSWORD has neither.

Neither is new in this release; #1246 just closed one specific case, and its commit message framed it as closing "a curl -u credential leak" rather than the broader class.

Proposed fix

Sweep the full redactLedgerDetail/maskString credential-flag catalog for common CLI credential idioms (mysql, psql/PG* env vars, and any other unseparated -X<value> or unconventional env-var-name patterns) and extend the regex catalog + add regression tests per idiom, following the same pattern as the #1246 fix.

Provenance

Found during the v0.11.0 stable release's Chaos Gremlin (privacy/compliance) persona review, verified by reading packages/opencode/src/session/compaction.ts.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions