fix(export): broaden SECRET_REGEX to cover Slack, Stripe, Discord, Google SA, future OR prefixes by la14-1 · Pull Request #3386 · OpenRouterLabs/spawn

la14-1 · 2026-05-02T10:21:52Z

Why: Closes known gaps in the SECRET_REGEX that would allow Slack tokens, Stripe live keys, Discord bot tokens, and future OpenRouter key prefixes to bypass the export redaction pass — the last line of defense before a potentially public gh repo create --push.

Fixes#3381

Changes

OpenRouter: widened from sk-or-v1-[a-f0-9]{20,} to sk-or-[a-zA-Z0-9_-]{20,} (covers v2+ prefixes and non-hex chars)
Slack: added xox[abp]-[0-9A-Za-z-]{10,} (bot/user/app tokens)
Stripe: added sk_live_[A-Za-z0-9]{24,} (live secret keys)
Discord: added [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} (bot tokens)
Google: added "type":\s*"service_account" (service account JSON blocks)
Added inline comments documenting each provider family
Updated tests to verify the new patterns
Bumped CLI version to 1.0.37

Skipped generic Authorization: Bearer pattern as too noisy for default mode (noted in issue as --strict only).

-- refactor/ux-engineer

la14-1 · 2026-05-05T05:05:55Z

Status check (2026-05-05):

Tests: 2175 pass, 2 fail (pre-existing flaky tests from fix(tests): use URL-based mock routing to fix flaky tests #3379 — unrelated to this PR)
Lint: biome check src/ — 0 errors (202 files checked)
No merge conflicts

This PR is green and ready for security review. The regex broadening covers Slack, Stripe, Discord, Google SA, and future OR prefixes as described.

-- refactor/pr-maintainer

la14-1 · 2026-05-06T22:17:46Z

Security Review: Broadened SECRET_REGEX

Verdict: LGTM — good coverage expansion

Changes Reviewed

The regex now covers:

OpenRouter — sk-or-[a-zA-Z0-9_-]{20,} (was sk-or-v1-[a-f0-9]{20,}) — correctly handles v2+ keys with non-hex chars
Slack — xox[abp]-[0-9A-Za-z-]{10,} — covers bot, user, and app tokens
Stripe — sk_live_[A-Za-z0-9]{24,} — live secret keys
Discord — [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} — bot token format (base64 user ID.timestamp.HMAC)
Google — "type":\s*"service_account" — matches service account JSON

Security Assessment

OpenRouter regex broadening — Critical fix. The old regex only matched sk-or-v1- with hex chars, meaning v2+ keys (or keys with base64url chars) would leak unredacted. Good catch.
Discord token pattern — The [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} pattern is broad enough to potentially false-positive on JWTs or other dot-separated base64 strings. However, for a redaction use case, false positives are far safer than false negatives. Acceptable tradeoff.
Google service account — Matching "type":\s*"service_account" detects the presence of a service account JSON but won't redact the actual private_key field on its own. However, the PEM pattern -----BEGIN.*PRIVATE KEY----- already catches that. Together they provide good coverage.
Delimiter fix (from PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384) — The regex uses | for alternation. PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384 already fixed the sed delimiter to # so the pipe chars in the regex don't break the sed command. Verified these work together.

Notes (non-blocking)

The {20,} minimum lengths are reasonable — short enough to catch truncated pastes in config files, long enough to avoid most false positives on common identifiers.
Test coverage is updated to verify the new patterns are present. Good.

-- refactor/security-auditor

la14-1 · 2026-05-09T18:16:32Z

Re-ran the failed Mock Tests check — the failing test (history > saveSpawnRecord > keeps all entries with no cap) timed out after 5000ms, which appears to be a flaky test unrelated to this PR's SECRET_REGEX changes. Monitoring the re-run.

-- refactor/pr-maintainer

la14-1 · 2026-05-12T20:35:07Z

Rebased onto main (was 1 commit behind). Verified in worktree: 2202/2204 tests pass, biome lint clean (0 errors). The 2 failures (hetzner-cov, digitalocean-token) are pre-existing cross-test fetch mock contamination — they pass in isolation and are addressed by #3406. PR is mergeable and ready for review.

-- refactor/pr-maintainer

la14-1 · 2026-05-18T00:32:28Z

Verified on current main (2026-05-18): lint clean (0 errors), 2203 pass / 3 fail (all pre-existing: hetzner-cov, digitalocean-token, applySpawnMdSetup base64). Branch is mergeable with no conflicts. Ready for review.

-- refactor/pr-maintainer

…ogle SA, future OR prefixes Closes known gaps in the secret-scan regex that would allow Slack tokens (xoxb/xoxp/xoxa), Stripe live keys (sk_live_), Discord bot tokens, Google service account JSON blocks, and future OpenRouter key prefixes (sk-or-v2+) to bypass the export redaction pass. Fixes#3381 Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

la14-1 · 2026-05-21T22:31:03Z

Rebased onto main (was 2 commits behind). Clean rebase, no conflicts. Awaiting human review.

-- refactor/pr-maintainer

la14-1 · 2026-05-02T10:21:52Z

Why: Closes known gaps in the SECRET_REGEX that would allow Slack tokens, Stripe live keys, Discord bot tokens, and future OpenRouter key prefixes to bypass the export redaction pass — the last line of defense before a potentially public gh repo create --push.

Fixes#3381

Changes

OpenRouter: widened from sk-or-v1-[a-f0-9]{20,} to sk-or-[a-zA-Z0-9_-]{20,} (covers v2+ prefixes and non-hex chars)
Slack: added xox[abp]-[0-9A-Za-z-]{10,} (bot/user/app tokens)
Stripe: added sk_live_[A-Za-z0-9]{24,} (live secret keys)
Discord: added [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} (bot tokens)
Google: added "type":\s*"service_account" (service account JSON blocks)
Added inline comments documenting each provider family
Updated tests to verify the new patterns
Bumped CLI version to 1.0.37

Skipped generic Authorization: Bearer pattern as too noisy for default mode (noted in issue as --strict only).

-- refactor/ux-engineer

la14-1 · 2026-05-05T05:05:55Z

Status check (2026-05-05):

Tests: 2175 pass, 2 fail (pre-existing flaky tests from fix(tests): use URL-based mock routing to fix flaky tests #3379 — unrelated to this PR)
Lint: biome check src/ — 0 errors (202 files checked)
No merge conflicts

This PR is green and ready for security review. The regex broadening covers Slack, Stripe, Discord, Google SA, and future OR prefixes as described.

-- refactor/pr-maintainer

la14-1 · 2026-05-06T22:17:46Z

Security Review: Broadened SECRET_REGEX

Verdict: LGTM — good coverage expansion

Changes Reviewed

The regex now covers:

OpenRouter — sk-or-[a-zA-Z0-9_-]{20,} (was sk-or-v1-[a-f0-9]{20,}) — correctly handles v2+ keys with non-hex chars
Slack — xox[abp]-[0-9A-Za-z-]{10,} — covers bot, user, and app tokens
Stripe — sk_live_[A-Za-z0-9]{24,} — live secret keys
Discord — [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} — bot token format (base64 user ID.timestamp.HMAC)
Google — "type":\s*"service_account" — matches service account JSON

Security Assessment

OpenRouter regex broadening — Critical fix. The old regex only matched sk-or-v1- with hex chars, meaning v2+ keys (or keys with base64url chars) would leak unredacted. Good catch.
Discord token pattern — The [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} pattern is broad enough to potentially false-positive on JWTs or other dot-separated base64 strings. However, for a redaction use case, false positives are far safer than false negatives. Acceptable tradeoff.
Google service account — Matching "type":\s*"service_account" detects the presence of a service account JSON but won't redact the actual private_key field on its own. However, the PEM pattern -----BEGIN.*PRIVATE KEY----- already catches that. Together they provide good coverage.
Delimiter fix (from PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384) — The regex uses | for alternation. PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384 already fixed the sed delimiter to # so the pipe chars in the regex don't break the sed command. Verified these work together.

Notes (non-blocking)

The {20,} minimum lengths are reasonable — short enough to catch truncated pastes in config files, long enough to avoid most false positives on common identifiers.
Test coverage is updated to verify the new patterns are present. Good.

-- refactor/security-auditor

la14-1 · 2026-05-09T18:16:32Z

Re-ran the failed Mock Tests check — the failing test (history > saveSpawnRecord > keeps all entries with no cap) timed out after 5000ms, which appears to be a flaky test unrelated to this PR's SECRET_REGEX changes. Monitoring the re-run.

-- refactor/pr-maintainer

la14-1 · 2026-05-12T20:35:07Z

Rebased onto main (was 1 commit behind). Verified in worktree: 2202/2204 tests pass, biome lint clean (0 errors). The 2 failures (hetzner-cov, digitalocean-token) are pre-existing cross-test fetch mock contamination — they pass in isolation and are addressed by #3406. PR is mergeable and ready for review.

-- refactor/pr-maintainer

la14-1 · 2026-05-18T00:32:28Z

Verified on current main (2026-05-18): lint clean (0 errors), 2203 pass / 3 fail (all pre-existing: hetzner-cov, digitalocean-token, applySpawnMdSetup base64). Branch is mergeable with no conflicts. Ready for review.

-- refactor/pr-maintainer

…ogle SA, future OR prefixes Closes known gaps in the secret-scan regex that would allow Slack tokens (xoxb/xoxp/xoxa), Stripe live keys (sk_live_), Discord bot tokens, Google service account JSON blocks, and future OpenRouter key prefixes (sk-or-v2+) to bypass the export redaction pass. Fixes#3381 Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

la14-1 · 2026-05-21T22:31:03Z

Rebased onto main (was 2 commits behind). Clean rebase, no conflicts. Awaiting human review.

-- refactor/pr-maintainer

la14-1 · 2026-05-02T10:21:52Z

Why: Closes known gaps in the SECRET_REGEX that would allow Slack tokens, Stripe live keys, Discord bot tokens, and future OpenRouter key prefixes to bypass the export redaction pass — the last line of defense before a potentially public gh repo create --push.

Fixes#3381

Changes

OpenRouter: widened from sk-or-v1-[a-f0-9]{20,} to sk-or-[a-zA-Z0-9_-]{20,} (covers v2+ prefixes and non-hex chars)
Slack: added xox[abp]-[0-9A-Za-z-]{10,} (bot/user/app tokens)
Stripe: added sk_live_[A-Za-z0-9]{24,} (live secret keys)
Discord: added [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} (bot tokens)
Google: added "type":\s*"service_account" (service account JSON blocks)
Added inline comments documenting each provider family
Updated tests to verify the new patterns
Bumped CLI version to 1.0.37

Skipped generic Authorization: Bearer pattern as too noisy for default mode (noted in issue as --strict only).

-- refactor/ux-engineer

la14-1 · 2026-05-05T05:05:55Z

Status check (2026-05-05):

Tests: 2175 pass, 2 fail (pre-existing flaky tests from fix(tests): use URL-based mock routing to fix flaky tests #3379 — unrelated to this PR)
Lint: biome check src/ — 0 errors (202 files checked)
No merge conflicts

This PR is green and ready for security review. The regex broadening covers Slack, Stripe, Discord, Google SA, and future OR prefixes as described.

-- refactor/pr-maintainer

la14-1 · 2026-05-06T22:17:46Z

Security Review: Broadened SECRET_REGEX

Verdict: LGTM — good coverage expansion

Changes Reviewed

The regex now covers:

OpenRouter — sk-or-[a-zA-Z0-9_-]{20,} (was sk-or-v1-[a-f0-9]{20,}) — correctly handles v2+ keys with non-hex chars
Slack — xox[abp]-[0-9A-Za-z-]{10,} — covers bot, user, and app tokens
Stripe — sk_live_[A-Za-z0-9]{24,} — live secret keys
Discord — [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} — bot token format (base64 user ID.timestamp.HMAC)
Google — "type":\s*"service_account" — matches service account JSON

Security Assessment

OpenRouter regex broadening — Critical fix. The old regex only matched sk-or-v1- with hex chars, meaning v2+ keys (or keys with base64url chars) would leak unredacted. Good catch.
Discord token pattern — The [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} pattern is broad enough to potentially false-positive on JWTs or other dot-separated base64 strings. However, for a redaction use case, false positives are far safer than false negatives. Acceptable tradeoff.
Google service account — Matching "type":\s*"service_account" detects the presence of a service account JSON but won't redact the actual private_key field on its own. However, the PEM pattern -----BEGIN.*PRIVATE KEY----- already catches that. Together they provide good coverage.
Delimiter fix (from PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384) — The regex uses | for alternation. PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384 already fixed the sed delimiter to # so the pipe chars in the regex don't break the sed command. Verified these work together.

Notes (non-blocking)

The {20,} minimum lengths are reasonable — short enough to catch truncated pastes in config files, long enough to avoid most false positives on common identifiers.
Test coverage is updated to verify the new patterns are present. Good.

-- refactor/security-auditor

la14-1 · 2026-05-09T18:16:32Z

Re-ran the failed Mock Tests check — the failing test (history > saveSpawnRecord > keeps all entries with no cap) timed out after 5000ms, which appears to be a flaky test unrelated to this PR's SECRET_REGEX changes. Monitoring the re-run.

-- refactor/pr-maintainer

la14-1 · 2026-05-12T20:35:07Z

Rebased onto main (was 1 commit behind). Verified in worktree: 2202/2204 tests pass, biome lint clean (0 errors). The 2 failures (hetzner-cov, digitalocean-token) are pre-existing cross-test fetch mock contamination — they pass in isolation and are addressed by #3406. PR is mergeable and ready for review.

-- refactor/pr-maintainer

la14-1 · 2026-05-18T00:32:28Z

Verified on current main (2026-05-18): lint clean (0 errors), 2203 pass / 3 fail (all pre-existing: hetzner-cov, digitalocean-token, applySpawnMdSetup base64). Branch is mergeable with no conflicts. Ready for review.

-- refactor/pr-maintainer

…ogle SA, future OR prefixes Closes known gaps in the secret-scan regex that would allow Slack tokens (xoxb/xoxp/xoxa), Stripe live keys (sk_live_), Discord bot tokens, Google service account JSON blocks, and future OpenRouter key prefixes (sk-or-v2+) to bypass the export redaction pass. Fixes#3381 Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

la14-1 · 2026-05-21T22:31:03Z

Rebased onto main (was 2 commits behind). Clean rebase, no conflicts. Awaiting human review.

-- refactor/pr-maintainer

la14-1 · 2026-05-02T10:21:52Z

Why: Closes known gaps in the SECRET_REGEX that would allow Slack tokens, Stripe live keys, Discord bot tokens, and future OpenRouter key prefixes to bypass the export redaction pass — the last line of defense before a potentially public gh repo create --push.

Fixes#3381

Changes

OpenRouter: widened from sk-or-v1-[a-f0-9]{20,} to sk-or-[a-zA-Z0-9_-]{20,} (covers v2+ prefixes and non-hex chars)
Slack: added xox[abp]-[0-9A-Za-z-]{10,} (bot/user/app tokens)
Stripe: added sk_live_[A-Za-z0-9]{24,} (live secret keys)
Discord: added [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} (bot tokens)
Google: added "type":\s*"service_account" (service account JSON blocks)
Added inline comments documenting each provider family
Updated tests to verify the new patterns
Bumped CLI version to 1.0.37

Skipped generic Authorization: Bearer pattern as too noisy for default mode (noted in issue as --strict only).

-- refactor/ux-engineer

la14-1 · 2026-05-05T05:05:55Z

Status check (2026-05-05):

Tests: 2175 pass, 2 fail (pre-existing flaky tests from fix(tests): use URL-based mock routing to fix flaky tests #3379 — unrelated to this PR)
Lint: biome check src/ — 0 errors (202 files checked)
No merge conflicts

This PR is green and ready for security review. The regex broadening covers Slack, Stripe, Discord, Google SA, and future OR prefixes as described.

-- refactor/pr-maintainer

la14-1 · 2026-05-06T22:17:46Z

Security Review: Broadened SECRET_REGEX

Verdict: LGTM — good coverage expansion

Changes Reviewed

The regex now covers:

OpenRouter — sk-or-[a-zA-Z0-9_-]{20,} (was sk-or-v1-[a-f0-9]{20,}) — correctly handles v2+ keys with non-hex chars
Slack — xox[abp]-[0-9A-Za-z-]{10,} — covers bot, user, and app tokens
Stripe — sk_live_[A-Za-z0-9]{24,} — live secret keys
Discord — [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} — bot token format (base64 user ID.timestamp.HMAC)
Google — "type":\s*"service_account" — matches service account JSON

Security Assessment

OpenRouter regex broadening — Critical fix. The old regex only matched sk-or-v1- with hex chars, meaning v2+ keys (or keys with base64url chars) would leak unredacted. Good catch.
Discord token pattern — The [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} pattern is broad enough to potentially false-positive on JWTs or other dot-separated base64 strings. However, for a redaction use case, false positives are far safer than false negatives. Acceptable tradeoff.
Google service account — Matching "type":\s*"service_account" detects the presence of a service account JSON but won't redact the actual private_key field on its own. However, the PEM pattern -----BEGIN.*PRIVATE KEY----- already catches that. Together they provide good coverage.
Delimiter fix (from PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384) — The regex uses | for alternation. PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384 already fixed the sed delimiter to # so the pipe chars in the regex don't break the sed command. Verified these work together.

Notes (non-blocking)

The {20,} minimum lengths are reasonable — short enough to catch truncated pastes in config files, long enough to avoid most false positives on common identifiers.
Test coverage is updated to verify the new patterns are present. Good.

-- refactor/security-auditor

la14-1 · 2026-05-09T18:16:32Z

Re-ran the failed Mock Tests check — the failing test (history > saveSpawnRecord > keeps all entries with no cap) timed out after 5000ms, which appears to be a flaky test unrelated to this PR's SECRET_REGEX changes. Monitoring the re-run.

-- refactor/pr-maintainer

la14-1 · 2026-05-12T20:35:07Z

Rebased onto main (was 1 commit behind). Verified in worktree: 2202/2204 tests pass, biome lint clean (0 errors). The 2 failures (hetzner-cov, digitalocean-token) are pre-existing cross-test fetch mock contamination — they pass in isolation and are addressed by #3406. PR is mergeable and ready for review.

-- refactor/pr-maintainer

la14-1 · 2026-05-18T00:32:28Z

Verified on current main (2026-05-18): lint clean (0 errors), 2203 pass / 3 fail (all pre-existing: hetzner-cov, digitalocean-token, applySpawnMdSetup base64). Branch is mergeable with no conflicts. Ready for review.

-- refactor/pr-maintainer

…ogle SA, future OR prefixes Closes known gaps in the secret-scan regex that would allow Slack tokens (xoxb/xoxp/xoxa), Stripe live keys (sk_live_), Discord bot tokens, Google service account JSON blocks, and future OpenRouter key prefixes (sk-or-v2+) to bypass the export redaction pass. Fixes#3381 Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

la14-1 · 2026-05-21T22:31:03Z

Rebased onto main (was 2 commits behind). Clean rebase, no conflicts. Awaiting human review.

-- refactor/pr-maintainer

la14-1 · 2026-05-02T10:21:52Z

Why: Closes known gaps in the SECRET_REGEX that would allow Slack tokens, Stripe live keys, Discord bot tokens, and future OpenRouter key prefixes to bypass the export redaction pass — the last line of defense before a potentially public gh repo create --push.

Fixes#3381

Changes

OpenRouter: widened from sk-or-v1-[a-f0-9]{20,} to sk-or-[a-zA-Z0-9_-]{20,} (covers v2+ prefixes and non-hex chars)
Slack: added xox[abp]-[0-9A-Za-z-]{10,} (bot/user/app tokens)
Stripe: added sk_live_[A-Za-z0-9]{24,} (live secret keys)
Discord: added [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} (bot tokens)
Google: added "type":\s*"service_account" (service account JSON blocks)
Added inline comments documenting each provider family
Updated tests to verify the new patterns
Bumped CLI version to 1.0.37

Skipped generic Authorization: Bearer pattern as too noisy for default mode (noted in issue as --strict only).

-- refactor/ux-engineer

la14-1 · 2026-05-05T05:05:55Z

Status check (2026-05-05):

Tests: 2175 pass, 2 fail (pre-existing flaky tests from fix(tests): use URL-based mock routing to fix flaky tests #3379 — unrelated to this PR)
Lint: biome check src/ — 0 errors (202 files checked)
No merge conflicts

This PR is green and ready for security review. The regex broadening covers Slack, Stripe, Discord, Google SA, and future OR prefixes as described.

-- refactor/pr-maintainer

la14-1 · 2026-05-06T22:17:46Z

Security Review: Broadened SECRET_REGEX

Verdict: LGTM — good coverage expansion

Changes Reviewed

The regex now covers:

OpenRouter — sk-or-[a-zA-Z0-9_-]{20,} (was sk-or-v1-[a-f0-9]{20,}) — correctly handles v2+ keys with non-hex chars
Slack — xox[abp]-[0-9A-Za-z-]{10,} — covers bot, user, and app tokens
Stripe — sk_live_[A-Za-z0-9]{24,} — live secret keys
Discord — [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} — bot token format (base64 user ID.timestamp.HMAC)
Google — "type":\s*"service_account" — matches service account JSON

Security Assessment

OpenRouter regex broadening — Critical fix. The old regex only matched sk-or-v1- with hex chars, meaning v2+ keys (or keys with base64url chars) would leak unredacted. Good catch.
Discord token pattern — The [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} pattern is broad enough to potentially false-positive on JWTs or other dot-separated base64 strings. However, for a redaction use case, false positives are far safer than false negatives. Acceptable tradeoff.
Google service account — Matching "type":\s*"service_account" detects the presence of a service account JSON but won't redact the actual private_key field on its own. However, the PEM pattern -----BEGIN.*PRIVATE KEY----- already catches that. Together they provide good coverage.
Delimiter fix (from PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384) — The regex uses | for alternation. PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384 already fixed the sed delimiter to # so the pipe chars in the regex don't break the sed command. Verified these work together.

Notes (non-blocking)

The {20,} minimum lengths are reasonable — short enough to catch truncated pastes in config files, long enough to avoid most false positives on common identifiers.
Test coverage is updated to verify the new patterns are present. Good.

-- refactor/security-auditor

la14-1 · 2026-05-09T18:16:32Z

Re-ran the failed Mock Tests check — the failing test (history > saveSpawnRecord > keeps all entries with no cap) timed out after 5000ms, which appears to be a flaky test unrelated to this PR's SECRET_REGEX changes. Monitoring the re-run.

-- refactor/pr-maintainer

la14-1 · 2026-05-12T20:35:07Z

Rebased onto main (was 1 commit behind). Verified in worktree: 2202/2204 tests pass, biome lint clean (0 errors). The 2 failures (hetzner-cov, digitalocean-token) are pre-existing cross-test fetch mock contamination — they pass in isolation and are addressed by #3406. PR is mergeable and ready for review.

-- refactor/pr-maintainer

la14-1 · 2026-05-18T00:32:28Z

Verified on current main (2026-05-18): lint clean (0 errors), 2203 pass / 3 fail (all pre-existing: hetzner-cov, digitalocean-token, applySpawnMdSetup base64). Branch is mergeable with no conflicts. Ready for review.

-- refactor/pr-maintainer

…ogle SA, future OR prefixes Closes known gaps in the secret-scan regex that would allow Slack tokens (xoxb/xoxp/xoxa), Stripe live keys (sk_live_), Discord bot tokens, Google service account JSON blocks, and future OpenRouter key prefixes (sk-or-v2+) to bypass the export redaction pass. Fixes#3381 Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

la14-1 · 2026-05-21T22:31:03Z

Rebased onto main (was 2 commits behind). Clean rebase, no conflicts. Awaiting human review.

-- refactor/pr-maintainer

la14-1 · 2026-05-02T10:21:52Z

Why: Closes known gaps in the SECRET_REGEX that would allow Slack tokens, Stripe live keys, Discord bot tokens, and future OpenRouter key prefixes to bypass the export redaction pass — the last line of defense before a potentially public gh repo create --push.

Fixes#3381

Changes

OpenRouter: widened from sk-or-v1-[a-f0-9]{20,} to sk-or-[a-zA-Z0-9_-]{20,} (covers v2+ prefixes and non-hex chars)
Slack: added xox[abp]-[0-9A-Za-z-]{10,} (bot/user/app tokens)
Stripe: added sk_live_[A-Za-z0-9]{24,} (live secret keys)
Discord: added [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} (bot tokens)
Google: added "type":\s*"service_account" (service account JSON blocks)
Added inline comments documenting each provider family
Updated tests to verify the new patterns
Bumped CLI version to 1.0.37

Skipped generic Authorization: Bearer pattern as too noisy for default mode (noted in issue as --strict only).

-- refactor/ux-engineer

la14-1 · 2026-05-05T05:05:55Z

Status check (2026-05-05):

Tests: 2175 pass, 2 fail (pre-existing flaky tests from fix(tests): use URL-based mock routing to fix flaky tests #3379 — unrelated to this PR)
Lint: biome check src/ — 0 errors (202 files checked)
No merge conflicts

This PR is green and ready for security review. The regex broadening covers Slack, Stripe, Discord, Google SA, and future OR prefixes as described.

-- refactor/pr-maintainer

la14-1 · 2026-05-06T22:17:46Z

Security Review: Broadened SECRET_REGEX

Verdict: LGTM — good coverage expansion

Changes Reviewed

The regex now covers:

OpenRouter — sk-or-[a-zA-Z0-9_-]{20,} (was sk-or-v1-[a-f0-9]{20,}) — correctly handles v2+ keys with non-hex chars
Slack — xox[abp]-[0-9A-Za-z-]{10,} — covers bot, user, and app tokens
Stripe — sk_live_[A-Za-z0-9]{24,} — live secret keys
Discord — [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} — bot token format (base64 user ID.timestamp.HMAC)
Google — "type":\s*"service_account" — matches service account JSON

Security Assessment

OpenRouter regex broadening — Critical fix. The old regex only matched sk-or-v1- with hex chars, meaning v2+ keys (or keys with base64url chars) would leak unredacted. Good catch.
Discord token pattern — The [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} pattern is broad enough to potentially false-positive on JWTs or other dot-separated base64 strings. However, for a redaction use case, false positives are far safer than false negatives. Acceptable tradeoff.
Google service account — Matching "type":\s*"service_account" detects the presence of a service account JSON but won't redact the actual private_key field on its own. However, the PEM pattern -----BEGIN.*PRIVATE KEY----- already catches that. Together they provide good coverage.
Delimiter fix (from PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384) — The regex uses | for alternation. PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384 already fixed the sed delimiter to # so the pipe chars in the regex don't break the sed command. Verified these work together.

Notes (non-blocking)

The {20,} minimum lengths are reasonable — short enough to catch truncated pastes in config files, long enough to avoid most false positives on common identifiers.
Test coverage is updated to verify the new patterns are present. Good.

-- refactor/security-auditor

la14-1 · 2026-05-09T18:16:32Z

Re-ran the failed Mock Tests check — the failing test (history > saveSpawnRecord > keeps all entries with no cap) timed out after 5000ms, which appears to be a flaky test unrelated to this PR's SECRET_REGEX changes. Monitoring the re-run.

-- refactor/pr-maintainer

la14-1 · 2026-05-12T20:35:07Z

Rebased onto main (was 1 commit behind). Verified in worktree: 2202/2204 tests pass, biome lint clean (0 errors). The 2 failures (hetzner-cov, digitalocean-token) are pre-existing cross-test fetch mock contamination — they pass in isolation and are addressed by #3406. PR is mergeable and ready for review.

-- refactor/pr-maintainer

la14-1 · 2026-05-18T00:32:28Z

Verified on current main (2026-05-18): lint clean (0 errors), 2203 pass / 3 fail (all pre-existing: hetzner-cov, digitalocean-token, applySpawnMdSetup base64). Branch is mergeable with no conflicts. Ready for review.

-- refactor/pr-maintainer

…ogle SA, future OR prefixes Closes known gaps in the secret-scan regex that would allow Slack tokens (xoxb/xoxp/xoxa), Stripe live keys (sk_live_), Discord bot tokens, Google service account JSON blocks, and future OpenRouter key prefixes (sk-or-v2+) to bypass the export redaction pass. Fixes#3381 Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

la14-1 · 2026-05-21T22:31:03Z

Rebased onto main (was 2 commits behind). Clean rebase, no conflicts. Awaiting human review.

-- refactor/pr-maintainer

la14-1 · 2026-05-02T10:21:52Z

Why: Closes known gaps in the SECRET_REGEX that would allow Slack tokens, Stripe live keys, Discord bot tokens, and future OpenRouter key prefixes to bypass the export redaction pass — the last line of defense before a potentially public gh repo create --push.

Fixes#3381

Changes

OpenRouter: widened from sk-or-v1-[a-f0-9]{20,} to sk-or-[a-zA-Z0-9_-]{20,} (covers v2+ prefixes and non-hex chars)
Slack: added xox[abp]-[0-9A-Za-z-]{10,} (bot/user/app tokens)
Stripe: added sk_live_[A-Za-z0-9]{24,} (live secret keys)
Discord: added [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} (bot tokens)
Google: added "type":\s*"service_account" (service account JSON blocks)
Added inline comments documenting each provider family
Updated tests to verify the new patterns
Bumped CLI version to 1.0.37

Skipped generic Authorization: Bearer pattern as too noisy for default mode (noted in issue as --strict only).

-- refactor/ux-engineer

la14-1 · 2026-05-05T05:05:55Z

Status check (2026-05-05):

Tests: 2175 pass, 2 fail (pre-existing flaky tests from fix(tests): use URL-based mock routing to fix flaky tests #3379 — unrelated to this PR)
Lint: biome check src/ — 0 errors (202 files checked)
No merge conflicts

This PR is green and ready for security review. The regex broadening covers Slack, Stripe, Discord, Google SA, and future OR prefixes as described.

-- refactor/pr-maintainer

la14-1 · 2026-05-06T22:17:46Z

Security Review: Broadened SECRET_REGEX

Verdict: LGTM — good coverage expansion

Changes Reviewed

The regex now covers:

OpenRouter — sk-or-[a-zA-Z0-9_-]{20,} (was sk-or-v1-[a-f0-9]{20,}) — correctly handles v2+ keys with non-hex chars
Slack — xox[abp]-[0-9A-Za-z-]{10,} — covers bot, user, and app tokens
Stripe — sk_live_[A-Za-z0-9]{24,} — live secret keys
Discord — [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} — bot token format (base64 user ID.timestamp.HMAC)
Google — "type":\s*"service_account" — matches service account JSON

Security Assessment

OpenRouter regex broadening — Critical fix. The old regex only matched sk-or-v1- with hex chars, meaning v2+ keys (or keys with base64url chars) would leak unredacted. Good catch.
Discord token pattern — The [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} pattern is broad enough to potentially false-positive on JWTs or other dot-separated base64 strings. However, for a redaction use case, false positives are far safer than false negatives. Acceptable tradeoff.
Google service account — Matching "type":\s*"service_account" detects the presence of a service account JSON but won't redact the actual private_key field on its own. However, the PEM pattern -----BEGIN.*PRIVATE KEY----- already catches that. Together they provide good coverage.
Delimiter fix (from PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384) — The regex uses | for alternation. PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384 already fixed the sed delimiter to # so the pipe chars in the regex don't break the sed command. Verified these work together.

Notes (non-blocking)

The {20,} minimum lengths are reasonable — short enough to catch truncated pastes in config files, long enough to avoid most false positives on common identifiers.
Test coverage is updated to verify the new patterns are present. Good.

-- refactor/security-auditor

la14-1 · 2026-05-09T18:16:32Z

Re-ran the failed Mock Tests check — the failing test (history > saveSpawnRecord > keeps all entries with no cap) timed out after 5000ms, which appears to be a flaky test unrelated to this PR's SECRET_REGEX changes. Monitoring the re-run.

-- refactor/pr-maintainer

la14-1 · 2026-05-12T20:35:07Z

Rebased onto main (was 1 commit behind). Verified in worktree: 2202/2204 tests pass, biome lint clean (0 errors). The 2 failures (hetzner-cov, digitalocean-token) are pre-existing cross-test fetch mock contamination — they pass in isolation and are addressed by #3406. PR is mergeable and ready for review.

-- refactor/pr-maintainer

la14-1 · 2026-05-18T00:32:28Z

Verified on current main (2026-05-18): lint clean (0 errors), 2203 pass / 3 fail (all pre-existing: hetzner-cov, digitalocean-token, applySpawnMdSetup base64). Branch is mergeable with no conflicts. Ready for review.

-- refactor/pr-maintainer

…ogle SA, future OR prefixes Closes known gaps in the secret-scan regex that would allow Slack tokens (xoxb/xoxp/xoxa), Stripe live keys (sk_live_), Discord bot tokens, Google service account JSON blocks, and future OpenRouter key prefixes (sk-or-v2+) to bypass the export redaction pass. Fixes#3381 Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

la14-1 · 2026-05-21T22:31:03Z

Rebased onto main (was 2 commits behind). Clean rebase, no conflicts. Awaiting human review.

-- refactor/pr-maintainer

la14-1 · 2026-05-02T10:21:52Z

Why: Closes known gaps in the SECRET_REGEX that would allow Slack tokens, Stripe live keys, Discord bot tokens, and future OpenRouter key prefixes to bypass the export redaction pass — the last line of defense before a potentially public gh repo create --push.

Fixes#3381

Changes

OpenRouter: widened from sk-or-v1-[a-f0-9]{20,} to sk-or-[a-zA-Z0-9_-]{20,} (covers v2+ prefixes and non-hex chars)
Slack: added xox[abp]-[0-9A-Za-z-]{10,} (bot/user/app tokens)
Stripe: added sk_live_[A-Za-z0-9]{24,} (live secret keys)
Discord: added [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} (bot tokens)
Google: added "type":\s*"service_account" (service account JSON blocks)
Added inline comments documenting each provider family
Updated tests to verify the new patterns
Bumped CLI version to 1.0.37

Skipped generic Authorization: Bearer pattern as too noisy for default mode (noted in issue as --strict only).

-- refactor/ux-engineer

la14-1 · 2026-05-05T05:05:55Z

Status check (2026-05-05):

Tests: 2175 pass, 2 fail (pre-existing flaky tests from fix(tests): use URL-based mock routing to fix flaky tests #3379 — unrelated to this PR)
Lint: biome check src/ — 0 errors (202 files checked)
No merge conflicts

This PR is green and ready for security review. The regex broadening covers Slack, Stripe, Discord, Google SA, and future OR prefixes as described.

-- refactor/pr-maintainer

la14-1 · 2026-05-06T22:17:46Z

Security Review: Broadened SECRET_REGEX

Verdict: LGTM — good coverage expansion

Changes Reviewed

The regex now covers:

OpenRouter — sk-or-[a-zA-Z0-9_-]{20,} (was sk-or-v1-[a-f0-9]{20,}) — correctly handles v2+ keys with non-hex chars
Slack — xox[abp]-[0-9A-Za-z-]{10,} — covers bot, user, and app tokens
Stripe — sk_live_[A-Za-z0-9]{24,} — live secret keys
Discord — [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} — bot token format (base64 user ID.timestamp.HMAC)
Google — "type":\s*"service_account" — matches service account JSON

Security Assessment

OpenRouter regex broadening — Critical fix. The old regex only matched sk-or-v1- with hex chars, meaning v2+ keys (or keys with base64url chars) would leak unredacted. Good catch.
Discord token pattern — The [A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,} pattern is broad enough to potentially false-positive on JWTs or other dot-separated base64 strings. However, for a redaction use case, false positives are far safer than false negatives. Acceptable tradeoff.
Google service account — Matching "type":\s*"service_account" detects the presence of a service account JSON but won't redact the actual private_key field on its own. However, the PEM pattern -----BEGIN.*PRIVATE KEY----- already catches that. Together they provide good coverage.
Delimiter fix (from PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384) — The regex uses | for alternation. PR fix(export): use '#' as sed delimiter (regex '|' was clashing) #3384 already fixed the sed delimiter to # so the pipe chars in the regex don't break the sed command. Verified these work together.

Notes (non-blocking)

The {20,} minimum lengths are reasonable — short enough to catch truncated pastes in config files, long enough to avoid most false positives on common identifiers.
Test coverage is updated to verify the new patterns are present. Good.

-- refactor/security-auditor

la14-1 · 2026-05-09T18:16:32Z

Re-ran the failed Mock Tests check — the failing test (history > saveSpawnRecord > keeps all entries with no cap) timed out after 5000ms, which appears to be a flaky test unrelated to this PR's SECRET_REGEX changes. Monitoring the re-run.

-- refactor/pr-maintainer

la14-1 · 2026-05-12T20:35:07Z

Rebased onto main (was 1 commit behind). Verified in worktree: 2202/2204 tests pass, biome lint clean (0 errors). The 2 failures (hetzner-cov, digitalocean-token) are pre-existing cross-test fetch mock contamination — they pass in isolation and are addressed by #3406. PR is mergeable and ready for review.

-- refactor/pr-maintainer

la14-1 · 2026-05-18T00:32:28Z

Verified on current main (2026-05-18): lint clean (0 errors), 2203 pass / 3 fail (all pre-existing: hetzner-cov, digitalocean-token, applySpawnMdSetup base64). Branch is mergeable with no conflicts. Ready for review.

-- refactor/pr-maintainer

…ogle SA, future OR prefixes Closes known gaps in the secret-scan regex that would allow Slack tokens (xoxb/xoxp/xoxa), Stripe live keys (sk_live_), Discord bot tokens, Google service account JSON blocks, and future OpenRouter key prefixes (sk-or-v2+) to bypass the export redaction pass. Fixes#3381 Agent: ux-engineer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

la14-1 · 2026-05-21T22:31:03Z

Rebased onto main (was 2 commits behind). Clean rebase, no conflicts. Awaiting human review.

-- refactor/pr-maintainer

la14-1 mentioned this pull request May 2, 2026
[CLI]: broaden spawn export secret-scan regex #3381
Open

la14-1 force-pushed the fix/broaden-secret-regex branch 2 times, most recently from 0e0ca56 to e8e7ed9Compare May 9, 2026 16:16

la14-1 force-pushed the fix/broaden-secret-regex branch 2 times, most recently from 1860fd5 to 4561048Compare May 12, 2026 20:35

la14-1 force-pushed the fix/broaden-secret-regex branch from 4561048 to f1e701aCompare May 14, 2026 14:52

la14-1 force-pushed the fix/broaden-secret-regex branch from f1e701a to 8f4b4a3Compare May 21, 2026 22:30