README: say WHY redaction is TS+Rust, so it stops reading as a parity gap by brentrager · Pull Request #116 · SmooAI/fetch

brentrager · 2026-08-20T19:49:59Z

A reviewer came within a step of filing a parity bug against the redaction work, because the evidence on main reads as "the security fix reached 2 of 5 ports":

spec/redaction-corpus.json is loaded by src/redact.spec.ts and rust/fetch/src/redact.rs only
Python, Go and .NET have zero matches for redact/sanitize/scrub/mask/client_secret

It reached 2 of the 2 ports that log anything about a request. The README now says so, right next to the language matrix, with the per-port evidence:

Language	What it logs about a request	Redaction
TypeScript	method, host, path, query, headers, body, URL in the message	full
Rust	method + URL, one `tracing::debug!` event	URL only
Python	nothing	n/a
Go	nothing	n/a
.NET	nothing (`ILogger<SmooFetch>` held for DI, never called)	n/a

Plus the reason a scrubber was not added to the other three: it would be code no call site reaches, which reads as a guarantee while guaranteeing nothing.

No test added for the "never logs a body" property in Python/Go/.NET. Asserting the absence of code that doesn't exist is brittle, and the forward-looking half of the rule already ships in the corpus itself: "Python, Go and .NET have no logging sink at all, so they implement nothing and load nothing; if a sink is ever added there, wire it to this corpus in the same PR." The README now points at that file, so the next person to add a logging call reads the rule before writing the leak.

Docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

… gap "redaction: TypeScript and Rust" with no explanation looks like the security fix reached 2 of 5 ports. It didn't: it reached 2 of the 2 ports that log anything about a request. Python and Go have no logging call at all, and .NET holds an ILogger<SmooFetch> for DI and never calls it. A reviewer already came within a step of filing that bug against the matrix, so the reasoning belongs next to the claim rather than in a PR description nobody reads twice. The corpus itself already carries the forward-looking half of the rule -- add a sink, wire it to the corpus in the same PR -- and the README now points at it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

changeset-bot · 2026-08-20T19:50:06Z

⚠️ No Changeset found

Latest commit: a0ec3b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

brentrager · 2026-08-20T19:49:59Z

A reviewer came within a step of filing a parity bug against the redaction work, because the evidence on main reads as "the security fix reached 2 of 5 ports":

spec/redaction-corpus.json is loaded by src/redact.spec.ts and rust/fetch/src/redact.rs only
Python, Go and .NET have zero matches for redact/sanitize/scrub/mask/client_secret

It reached 2 of the 2 ports that log anything about a request. The README now says so, right next to the language matrix, with the per-port evidence:

Language	What it logs about a request	Redaction
TypeScript	method, host, path, query, headers, body, URL in the message	full
Rust	method + URL, one `tracing::debug!` event	URL only
Python	nothing	n/a
Go	nothing	n/a
.NET	nothing (`ILogger<SmooFetch>` held for DI, never called)	n/a

Plus the reason a scrubber was not added to the other three: it would be code no call site reaches, which reads as a guarantee while guaranteeing nothing.

No test added for the "never logs a body" property in Python/Go/.NET. Asserting the absence of code that doesn't exist is brittle, and the forward-looking half of the rule already ships in the corpus itself: "Python, Go and .NET have no logging sink at all, so they implement nothing and load nothing; if a sink is ever added there, wire it to this corpus in the same PR." The README now points at that file, so the next person to add a logging call reads the rule before writing the leak.

Docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

… gap "redaction: TypeScript and Rust" with no explanation looks like the security fix reached 2 of 5 ports. It didn't: it reached 2 of the 2 ports that log anything about a request. Python and Go have no logging call at all, and .NET holds an ILogger<SmooFetch> for DI and never calls it. A reviewer already came within a step of filing that bug against the matrix, so the reasoning belongs next to the claim rather than in a PR description nobody reads twice. The corpus itself already carries the forward-looking half of the rule -- add a sink, wire it to the corpus in the same PR -- and the README now points at it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

changeset-bot · 2026-08-20T19:50:06Z

⚠️ No Changeset found

Latest commit: a0ec3b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

brentrager · 2026-08-20T19:49:59Z

A reviewer came within a step of filing a parity bug against the redaction work, because the evidence on main reads as "the security fix reached 2 of 5 ports":

spec/redaction-corpus.json is loaded by src/redact.spec.ts and rust/fetch/src/redact.rs only
Python, Go and .NET have zero matches for redact/sanitize/scrub/mask/client_secret

It reached 2 of the 2 ports that log anything about a request. The README now says so, right next to the language matrix, with the per-port evidence:

Language	What it logs about a request	Redaction
TypeScript	method, host, path, query, headers, body, URL in the message	full
Rust	method + URL, one `tracing::debug!` event	URL only
Python	nothing	n/a
Go	nothing	n/a
.NET	nothing (`ILogger<SmooFetch>` held for DI, never called)	n/a

Plus the reason a scrubber was not added to the other three: it would be code no call site reaches, which reads as a guarantee while guaranteeing nothing.

No test added for the "never logs a body" property in Python/Go/.NET. Asserting the absence of code that doesn't exist is brittle, and the forward-looking half of the rule already ships in the corpus itself: "Python, Go and .NET have no logging sink at all, so they implement nothing and load nothing; if a sink is ever added there, wire it to this corpus in the same PR." The README now points at that file, so the next person to add a logging call reads the rule before writing the leak.

Docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

… gap "redaction: TypeScript and Rust" with no explanation looks like the security fix reached 2 of 5 ports. It didn't: it reached 2 of the 2 ports that log anything about a request. Python and Go have no logging call at all, and .NET holds an ILogger<SmooFetch> for DI and never calls it. A reviewer already came within a step of filing that bug against the matrix, so the reasoning belongs next to the claim rather than in a PR description nobody reads twice. The corpus itself already carries the forward-looking half of the rule -- add a sink, wire it to the corpus in the same PR -- and the README now points at it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

changeset-bot · 2026-08-20T19:50:06Z

⚠️ No Changeset found

Latest commit: a0ec3b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

brentrager · 2026-08-20T19:49:59Z

A reviewer came within a step of filing a parity bug against the redaction work, because the evidence on main reads as "the security fix reached 2 of 5 ports":

spec/redaction-corpus.json is loaded by src/redact.spec.ts and rust/fetch/src/redact.rs only
Python, Go and .NET have zero matches for redact/sanitize/scrub/mask/client_secret

It reached 2 of the 2 ports that log anything about a request. The README now says so, right next to the language matrix, with the per-port evidence:

Language	What it logs about a request	Redaction
TypeScript	method, host, path, query, headers, body, URL in the message	full
Rust	method + URL, one `tracing::debug!` event	URL only
Python	nothing	n/a
Go	nothing	n/a
.NET	nothing (`ILogger<SmooFetch>` held for DI, never called)	n/a

Plus the reason a scrubber was not added to the other three: it would be code no call site reaches, which reads as a guarantee while guaranteeing nothing.

No test added for the "never logs a body" property in Python/Go/.NET. Asserting the absence of code that doesn't exist is brittle, and the forward-looking half of the rule already ships in the corpus itself: "Python, Go and .NET have no logging sink at all, so they implement nothing and load nothing; if a sink is ever added there, wire it to this corpus in the same PR." The README now points at that file, so the next person to add a logging call reads the rule before writing the leak.

Docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

… gap "redaction: TypeScript and Rust" with no explanation looks like the security fix reached 2 of 5 ports. It didn't: it reached 2 of the 2 ports that log anything about a request. Python and Go have no logging call at all, and .NET holds an ILogger<SmooFetch> for DI and never calls it. A reviewer already came within a step of filing that bug against the matrix, so the reasoning belongs next to the claim rather than in a PR description nobody reads twice. The corpus itself already carries the forward-looking half of the rule -- add a sink, wire it to the corpus in the same PR -- and the README now points at it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

changeset-bot · 2026-08-20T19:50:06Z

⚠️ No Changeset found

Latest commit: a0ec3b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

brentrager · 2026-08-20T19:49:59Z

A reviewer came within a step of filing a parity bug against the redaction work, because the evidence on main reads as "the security fix reached 2 of 5 ports":

spec/redaction-corpus.json is loaded by src/redact.spec.ts and rust/fetch/src/redact.rs only
Python, Go and .NET have zero matches for redact/sanitize/scrub/mask/client_secret

It reached 2 of the 2 ports that log anything about a request. The README now says so, right next to the language matrix, with the per-port evidence:

Language	What it logs about a request	Redaction
TypeScript	method, host, path, query, headers, body, URL in the message	full
Rust	method + URL, one `tracing::debug!` event	URL only
Python	nothing	n/a
Go	nothing	n/a
.NET	nothing (`ILogger<SmooFetch>` held for DI, never called)	n/a

Plus the reason a scrubber was not added to the other three: it would be code no call site reaches, which reads as a guarantee while guaranteeing nothing.

No test added for the "never logs a body" property in Python/Go/.NET. Asserting the absence of code that doesn't exist is brittle, and the forward-looking half of the rule already ships in the corpus itself: "Python, Go and .NET have no logging sink at all, so they implement nothing and load nothing; if a sink is ever added there, wire it to this corpus in the same PR." The README now points at that file, so the next person to add a logging call reads the rule before writing the leak.

Docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

… gap "redaction: TypeScript and Rust" with no explanation looks like the security fix reached 2 of 5 ports. It didn't: it reached 2 of the 2 ports that log anything about a request. Python and Go have no logging call at all, and .NET holds an ILogger<SmooFetch> for DI and never calls it. A reviewer already came within a step of filing that bug against the matrix, so the reasoning belongs next to the claim rather than in a PR description nobody reads twice. The corpus itself already carries the forward-looking half of the rule -- add a sink, wire it to the corpus in the same PR -- and the README now points at it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

changeset-bot · 2026-08-20T19:50:06Z

⚠️ No Changeset found

Latest commit: a0ec3b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

brentrager · 2026-08-20T19:49:59Z

A reviewer came within a step of filing a parity bug against the redaction work, because the evidence on main reads as "the security fix reached 2 of 5 ports":

spec/redaction-corpus.json is loaded by src/redact.spec.ts and rust/fetch/src/redact.rs only
Python, Go and .NET have zero matches for redact/sanitize/scrub/mask/client_secret

It reached 2 of the 2 ports that log anything about a request. The README now says so, right next to the language matrix, with the per-port evidence:

Language	What it logs about a request	Redaction
TypeScript	method, host, path, query, headers, body, URL in the message	full
Rust	method + URL, one `tracing::debug!` event	URL only
Python	nothing	n/a
Go	nothing	n/a
.NET	nothing (`ILogger<SmooFetch>` held for DI, never called)	n/a

Plus the reason a scrubber was not added to the other three: it would be code no call site reaches, which reads as a guarantee while guaranteeing nothing.

No test added for the "never logs a body" property in Python/Go/.NET. Asserting the absence of code that doesn't exist is brittle, and the forward-looking half of the rule already ships in the corpus itself: "Python, Go and .NET have no logging sink at all, so they implement nothing and load nothing; if a sink is ever added there, wire it to this corpus in the same PR." The README now points at that file, so the next person to add a logging call reads the rule before writing the leak.

Docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

… gap "redaction: TypeScript and Rust" with no explanation looks like the security fix reached 2 of 5 ports. It didn't: it reached 2 of the 2 ports that log anything about a request. Python and Go have no logging call at all, and .NET holds an ILogger<SmooFetch> for DI and never calls it. A reviewer already came within a step of filing that bug against the matrix, so the reasoning belongs next to the claim rather than in a PR description nobody reads twice. The corpus itself already carries the forward-looking half of the rule -- add a sink, wire it to the corpus in the same PR -- and the README now points at it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

changeset-bot · 2026-08-20T19:50:06Z

⚠️ No Changeset found

Latest commit: a0ec3b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

brentrager · 2026-08-20T19:49:59Z

A reviewer came within a step of filing a parity bug against the redaction work, because the evidence on main reads as "the security fix reached 2 of 5 ports":

spec/redaction-corpus.json is loaded by src/redact.spec.ts and rust/fetch/src/redact.rs only
Python, Go and .NET have zero matches for redact/sanitize/scrub/mask/client_secret

It reached 2 of the 2 ports that log anything about a request. The README now says so, right next to the language matrix, with the per-port evidence:

Language	What it logs about a request	Redaction
TypeScript	method, host, path, query, headers, body, URL in the message	full
Rust	method + URL, one `tracing::debug!` event	URL only
Python	nothing	n/a
Go	nothing	n/a
.NET	nothing (`ILogger<SmooFetch>` held for DI, never called)	n/a

Plus the reason a scrubber was not added to the other three: it would be code no call site reaches, which reads as a guarantee while guaranteeing nothing.

No test added for the "never logs a body" property in Python/Go/.NET. Asserting the absence of code that doesn't exist is brittle, and the forward-looking half of the rule already ships in the corpus itself: "Python, Go and .NET have no logging sink at all, so they implement nothing and load nothing; if a sink is ever added there, wire it to this corpus in the same PR." The README now points at that file, so the next person to add a logging call reads the rule before writing the leak.

Docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

… gap "redaction: TypeScript and Rust" with no explanation looks like the security fix reached 2 of 5 ports. It didn't: it reached 2 of the 2 ports that log anything about a request. Python and Go have no logging call at all, and .NET holds an ILogger<SmooFetch> for DI and never calls it. A reviewer already came within a step of filing that bug against the matrix, so the reasoning belongs next to the claim rather than in a PR description nobody reads twice. The corpus itself already carries the forward-looking half of the rule -- add a sink, wire it to the corpus in the same PR -- and the README now points at it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

changeset-bot · 2026-08-20T19:50:06Z

⚠️ No Changeset found

Latest commit: a0ec3b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

brentrager · 2026-08-20T19:49:59Z

A reviewer came within a step of filing a parity bug against the redaction work, because the evidence on main reads as "the security fix reached 2 of 5 ports":

spec/redaction-corpus.json is loaded by src/redact.spec.ts and rust/fetch/src/redact.rs only
Python, Go and .NET have zero matches for redact/sanitize/scrub/mask/client_secret

It reached 2 of the 2 ports that log anything about a request. The README now says so, right next to the language matrix, with the per-port evidence:

Language	What it logs about a request	Redaction
TypeScript	method, host, path, query, headers, body, URL in the message	full
Rust	method + URL, one `tracing::debug!` event	URL only
Python	nothing	n/a
Go	nothing	n/a
.NET	nothing (`ILogger<SmooFetch>` held for DI, never called)	n/a

Plus the reason a scrubber was not added to the other three: it would be code no call site reaches, which reads as a guarantee while guaranteeing nothing.

No test added for the "never logs a body" property in Python/Go/.NET. Asserting the absence of code that doesn't exist is brittle, and the forward-looking half of the rule already ships in the corpus itself: "Python, Go and .NET have no logging sink at all, so they implement nothing and load nothing; if a sink is ever added there, wire it to this corpus in the same PR." The README now points at that file, so the next person to add a logging call reads the rule before writing the leak.

Docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

… gap "redaction: TypeScript and Rust" with no explanation looks like the security fix reached 2 of 5 ports. It didn't: it reached 2 of the 2 ports that log anything about a request. Python and Go have no logging call at all, and .NET holds an ILogger<SmooFetch> for DI and never calls it. A reviewer already came within a step of filing that bug against the matrix, so the reasoning belongs next to the claim rather than in a PR description nobody reads twice. The corpus itself already carries the forward-looking half of the rule -- add a sink, wire it to the corpus in the same PR -- and the README now points at it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC

changeset-bot · 2026-08-20T19:50:06Z

⚠️ No Changeset found

Latest commit: a0ec3b4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

brentrager merged commit 7023068 into mainAug 20, 2026
6 checks passed

brentrager deleted the fix/readme-redaction-scope branch August 20, 2026 19:53