GeezerVison

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 6:07pm

PR Summary

Medium Risk
Changes secret redaction and provenance projection behavior for short literals across logs and Copilot; detection stays conservative while render is intentionally narrower, with broad test coverage.

Overview
Short resolved-secret literals (under 8 characters) no longer get substituted when they appear inside another token (e.g. test inside latest). Detection still treats those hits as matches everywhere; render (logs, Copilot, trace projection) only replaces them on word boundaries (standalone, delimited, or underscore-joined identifiers).

This adds a length-based match policy module and a detect / render mode on createResolvedSecretMatcher. Model egress, trace secret projection, and invariant checks build matchers with mode: 'render' so post-checks align with what was actually rewritten. sanitizeResolvedSecretString can run a few settle passes when a substitution exposes a boundary that was previously suppressed.

^{Reviewed by Cursor Bugbot for commit d5cc241. Configure here.}

Greptile Summary

This PR separates detection from rendering and applies boundary-only projection to resolved secret values shorter than eight characters, preventing coincidental substitutions inside ordinary text.

• Adds a shared short-secret matching policy with Unicode-aware boundary handling.
• Adds render-mode matching and bounded multi-pass substitution to the resolved-secret matcher.
• Applies render mode to model-content, Copilot-result, and trace projection paths.
• Expands tests for boundary matching, replacement settling, provenance labels, and trace behavior.

Confidence Score: 3/5

This PR is not safe to merge until embedded short active secrets are prevented from reaching Copilot and persisted trace outputs.

The new render policy deliberately retains sub-eight-character secrets inside alphanumeric tokens, while model and trace projection paths—including trace invariant enforcement—use that same restricted policy.

Files Needing Attention: apps/sim/lib/logs/execution/trace-secret-projection.ts, apps/sim/executor/utils/resolved-secret-content-projection.ts, apps/sim/executor/utils/resolved-secret-matcher.ts

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Active resolved-secret matches] --> B{Matcher mode}
  B -->|detect| C[Match at any offset]
  B -->|render| D{Secret length at least 8?}
  D -->|yes| C
  D -->|no| E{Word-boundary match?}
  E -->|yes| F[Replace with provenance label]
  E -->|no| G[Leave plaintext unchanged]
  F --> H[Copilot or trace output]
  G --> H
  H --> I[Render-mode invariant check]
  I -->|Same embedded match suppressed| H

_{Reviews (1): Last reviewed commit: "Merge commit '3b0651ed9c' into staging-v..." | Re-trigger Greptile}