From fbab5c4669ec3720ebc34161fcfff2452884fd32 Mon Sep 17 00:00:00 2001 From: Kit OC5 Date: Thu, 1 Oct 2026 02:47:53 -0400 Subject: [PATCH] secret-guard/secret-scan: PyPI API token shape (pypi-AgE macaroon), WARN-first Co-Authored-By: Claude Sonnet 5.5 --- api/tests/test_secret_guard.py | 8 ++++++++ scripts/secret_shapes.py | 3 ++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/api/tests/test_secret_guard.py b/api/tests/test_secret_guard.py index e7b2156..36aa3fb 100644 --- a/api/tests/test_secret_guard.py +++ b/api/tests/test_secret_guard.py @@ -146,3 +146,11 @@ def test_warn_kinds_do_not_block(monkeypatch): assert sg.status_for([f], True)[0] == "success" monkeypatch.setattr(sg, "WARN_KINDS", set()) assert sg.status_for([f], True)[0] == "failure" + + +def test_pypi_token_shape_hash_only(): + tok = "pypi-AgE" + "Ab1_-" * 20 # synthetic + got = ss.find(f"password = {tok}") + assert [k for k, _ in got] == ["pypi token"] and got[0][1] == ss.h8(tok) + assert tok not in repr(got) + assert ss.find("pypi-AgE-too-short") == [] diff --git a/scripts/secret_shapes.py b/scripts/secret_shapes.py index 533f9ba..d63efe5 100644 --- a/scripts/secret_shapes.py +++ b/scripts/secret_shapes.py @@ -23,13 +23,14 @@ PATTERNS: list[tuple[str, re.Pattern[str]]] = [ ("twilio sid/api key", re.compile(r"\b(?:AC|SK)[0-9a-f]{32}\b")), ("32-hex secret assignment", re.compile( r"(?i)\b[a-z0-9_.-]*(?:token|secret|key|password)[a-z0-9_.-]*[\"']?\s*[:=]\s*[\"']?(?P(? str: