docs(security): add CWE-78 scope regression + F1085 redactSecrets changelog entries - #77
Merged
molecule-ai[bot] merged 2 commits intoApr 22, 2026
Merged
Conversation
…ntries 2026-04-21 — CWE-78: Scope Refinement in deleteViaEphemeral - PRs #1310 (original), #1328 (scope refinement) - Commit 64ccf8e removes user-supplied scope argument from rm command - Prevents path traversal within validated path 2026-04-21 — F1085: Credential Scrub Before Workspace Memory Seeding - PRs #1203, #1206 - seedInitialMemories() now calls redactSecrets() before INSERT - Templates with API keys no longer stored in plain text in agent_memories Co-Authored-By: Technical Writer Agent <technical-writer@agents.moleculesai.app>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…ty description - Commit: 64ccf8e → f3ec07a - Vulnerability: corrected from "scope manipulation" framing to accurate "exec-form rm regression causing volume-wide deletion" description. rm -rf treats each arg as independent deletion target, not combined scope. Bug is a regression from the PR #1310 exec-form refactor. Co-Authored-By: Technical Writer Agent <technical-writer@agents.moleculesai.app>
Contributor
Author
|
CWE-78 correction applied by App-FE The CWE-78 scope entry has been updated with two accuracy fixes:
The bug: the PR #1310 exec-form refactor used PR #77 is now ready for final approval and merge. |
molecule-ai Bot
added a commit
that referenced
this pull request
Apr 22, 2026
The CWE-78 Scope Refinement and F1085 entries were added at the wrong nested path: BAD: content/docs/security/content/docs/security/changelog.md GOOD: content/docs/security/changelog.md This revert removes the bad file from main. The correct-path file (content/docs/security/changelog.md) has the original 5 entries and will be the build source going forward. A follow-up PR will add the two missing entries at the correct path. Closes: docs site ECONNREFUSED (Vercel build failure)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds two missing security entries to
docs/security/changelog.mdfor fixes that are present onmolecule-core mainbut were never documented.Entry 1 — 2026-04-21: CWE-78 Exec-Form
rmRegression indeleteViaEphemeralPRs #1310 (original fix) + #1328 (scope refinement), commit
f3ec07a.The exec-form refactor (PR #1310) replaced shell string interpolation with
exec.Command("rm", "-rf", "/configs", filePath). However,rm -rftreats each argument as an independent deletion target — not a combined scope. Both/configsandfilePathare deleted as separate top-level directories, causing unintended volume-wide deletion. Commitf3ec07afixes the regression by passing only the single target path torm.Entry 2 — 2026-04-21: F1085 Credential Scrub Before Workspace Memory Seeding
PRs #1203 + #1206, commit
6534014.seedInitialMemories()was inserting template memories intoagent_memorieswithout callingredactSecrets(). Workspaces provisioned from templates containing API keys or tokens stored those credentials in plain text. Fix: callredactSecrets()before INSERT.Test plan
🤖 Generated with Claude Code