From 8690c4f8d38d5868d0ec9ba05d1227171b6899b6 Mon Sep 17 00:00:00 2001 From: Kit OC5 Date: Mon, 28 Sep 2026 06:13:22 -0400 Subject: [PATCH] secret-guard allow: 5 windy-agent #395 FAKE fixtures (weekly scan 09-28; verified never in the lockbox) Co-Authored-By: Claude Opus 5.5 --- ci/secret-guard-allow.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ci/secret-guard-allow.yml b/ci/secret-guard-allow.yml index dd3b99a..1059f58 100644 --- a/ci/secret-guard-allow.yml +++ b/ci/secret-guard-allow.yml @@ -19,6 +19,9 @@ allow: - repo: windy-agent hashes: [a9235a6d, dd6a2baa, 02c362d8, a6f6ff79, f7503b21, d0c94833, 4ab092e3, e3aa1eb8, 833382ee] reason: "Redaction/sanitizer test fixtures; lengths impossible for real Anthropic/OpenAI keys; never in the lockbox." + - repo: windy-agent + hashes: [89bd408f, b8c94b72, bf23cdf5, d1d85dfe, e3e07f06] + reason: "09-24 #395 replacement fixtures (each contains FAKE; token-SHAPED on purpose so redaction tests prove real tokens are scrubbed); verified by Windy Agent sha-for-sha against every lockbox version: never real. Weekly scan 09-28." - repo: windy-agent paths: ["tests/test_agent_keys.py"] kinds: [private key block]