Pre-launch — Gluecron is in final validation. Public signups and git hosting for non-owner users open after launch review.
ccantynz/Gluecron.com
Commit0da2e8e

revert: undo auto-redact of secret-scanner test fixtures

revert: undo auto-redact of secret-scanner test fixtures

Reverts 2f1a07d ("fix(security): auto-redact leaked secrets"), which the
platform's own secret-scan auto-repair pushed onto this PR branch.

All 20 "findings" were deliberately fake fixtures in three test files that
exist precisely to exercise the secret scanner. Nothing real leaked and
there is nothing to rotate, despite the commit's "ACTION REQUIRED: these
credentials must be rotated" claim.

The auto-repair broke the suite in two distinct ways:

1. It replaced fixture secrets with the literal "REDACTED_BY_GLUECRON",
   so inputs that are supposed to trip the scanner no longer do:
     expect(active.length).toBe(1)   -> 0 findings
     expect(active[0]).not.toContain(...) -> active[0] undefined, test errors
   The assertion that the scanner must not echo a secret back is now
   vacuous — it checks the rejection message doesn't contain the redaction
   marker, which was never the point.

2. It "redacted" by commenting out whole lines *inside* an object literal
   and an array literal, silently changing their contents:
     env-health.test.ts   — drops SSH_HOST_KEY from the FULL_ENV fixture
     push-policy-...ts    — drops an element, so toBe(2) now sees 1

Verified: checking out 2f1a07d and running the three affected files gives
96 pass / 5 fail. After this revert they are green again.

Filed separately as a launch blocker: an automated agent holds write
access to PR branches, rewrites source without asking, cannot distinguish
a test fixture from a live credential, and then reports the gate as
"Secret scan: Passed / ready to merge" over code it just broke.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ccantynz-alt committed on July 27, 2026Parent: 28b52be
3 files changed+7−70da2e8ed2247b19ebaca122482031e08a570f594
3 changed files+7−7
Modifiedsrc/__tests__/env-health.test.ts+1−1View fileUnifiedSplit
3030 PREVIEW_DOMAIN: "https://previews.gluecron.com",
3131 SENTRY_DSN: "https://abc@o1.ingest.sentry.io/1",
3232 ERROR_WEBHOOK_URL: "https://hooks.example.com/errors",
33// SSH_HOST_KEY: "-----BEGIN OPENSSH PRIVATE KEY-----secret-fff", // REDACTED_BY_GLUECRON
33 SSH_HOST_KEY: "-----BEGIN OPENSSH PRIVATE KEY-----secret-fff",
3434 REDIS_URL: "redis://:redis-secret-ggg@localhost:6379",
3535 GOOGLE_OAUTH_CLIENT_ID: "abc.apps.googleusercontent.com",
3636 GOOGLE_OAUTH_CLIENT_SECRET: "google-secret-hhh",
Modifiedsrc/__tests__/green-ecosystem.test.ts+1−1View fileUnifiedSplit
6161 {
6262 path: "app.ts",
6363 content:
64 'const key = "REDACTED_BY_GLUECRON";',
64 'const key = "sk-ant-api03-QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ-AAAAAA";',
6565 },
6666 ]);
6767 expect(findings.some((f) => /anthropic/i.test(f.type))).toBe(true);
Modifiedsrc/__tests__/push-policy-secret-scan.test.ts+5−5View fileUnifiedSplit
8181
8282 it("blocks a critical secret (AWS access key) in a normal source file", async () => {
8383 const { active, stderr } = await runEval([
84 fileLine("src/config.ts", "const AWS_KEY = 'REDACTED_BY_GLUECRON';\n"),
84 fileLine("src/config.ts", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"),
8585 ]);
8686 expect(stderr).toBe("");
8787 expect(active.length).toBe(1);
9191
9292 it("does not leak the secret value itself into the rejection message", async () => {
9393 const { active } = await runEval([
94 fileLine("src/config.ts", "const AWS_KEY = 'REDACTED_BY_GLUECRON';\n"),
94 fileLine("src/config.ts", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"),
9595 ]);
96 expect(active[0]).not.toContain("REDACTED_BY_GLUECRON");
96 expect(active[0]).not.toContain("AKIAABCDEFGH1234IJKL");
9797 });
9898
9999 it("does not block an obvious placeholder value", async () => {
105105
106106 it("does not scan skip-listed paths (build output, lockfiles)", async () => {
107107 const { active } = await runEval([
108 fileLine("dist/bundle.js", "const AWS_KEY = 'REDACTED_BY_GLUECRON';\n"),
108 fileLine("dist/bundle.js", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"),
109109 ]);
110110 expect(active.length).toBe(0);
111111 });
120120 it("scans multiple files and reports one violation per match", async () => {
121121 const { active } = await runEval([
122122 fileLine("a.ts", "AKIAABCDEFGH1234IJKL\n"),
123// fileLine("b.ts", "-----BEGIN RSA PRIVATE KEY-----\n"), // REDACTED_BY_GLUECRON
123 fileLine("b.ts", "-----BEGIN RSA PRIVATE KEY-----\n"),
124124 fileLine("c.ts", "nothing interesting here\n"),
125125 ]);
126126 expect(active.length).toBe(2);
127127