feat(security): extend secret detection coverage (GitLab/Doppler/Google) - #797
Conversation
scanner と inline-secret フックの両層に、これまで未対応だったトークン種別を 追加。検出は多層（混入を入口で止め、混入済みを scan で検出）で揃える。 ## scanner (security-credential-scan.sh) - PATTERNS に GitLab PAT (glpat-…) と Doppler Token (dp.<type>.…) を追加 - 両者を CRITICAL 重大度に分類 ## hook (block_inline_secrets.py) - SECRET_PATTERNS に Google API key (AIza…) / GitLab PAT / Doppler Token を追加 （scanner には既にあった Google を inline 側にも揃える） ## tests - security-scripts.bats: .claude 設定内の GitLab/Doppler を検出するケース追加 - hooks-command-safety.test.js: 3 種別のパターン存在アサーション追加 - behavioral 確認: 実トークン3種を block、変数参照/`doppler run`/通常commit は allow Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR expands credential detection coverage by adding patterns for Google API keys, GitLab personal access tokens, and Doppler tokens to both the inline-secret hook and the file-scanning script. GitLab and Doppler findings are classified as CRITICAL severity. Unit and integration tests validate the new patterns. ChangesCredential Detection Expansion
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
test/hooks-command-safety.test.jsOops! Something went wrong! :( ESLint: 10.4.1 ReferenceError: describe is not defined Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Claude finished @keito4's task in 3m 4s —— View job PR #797 コードレビュー
総評Approve（minor 観点のみ）。変更は検出種別の追加のみで、既存ロジックへの影響はなし。パターンの精度・重大度分類・テスト戦略いずれも適切。以下、観点別の詳細。 Security ✅
Minor — GitLab PAT の文字数が厳密一致（
-PATTERNS["GitLab PAT"]="glpat-[a-zA-Z0-9_-]{20}"
+PATTERNS["GitLab PAT"]="glpat-[a-zA-Z0-9_-]{20,}"Quality ✅テスト戦略の評価
Minor — フック単体の振る舞いテストが不在 bats テストは scanner の動作を検証しているが、hook（ JS テストは Performance ✅パターン追加による処理コストは無視できるレベル。ループ毎に AI Residuals ✅テスト内にハードコードされた実トークンの混入なし（runtime 生成で適切に回避）。 その他観察事項注: CI ランナー上の作業ツリーで まとめ
Verdict: APPROVE（GitLab PAT の |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a2ab5ed2a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| PATTERNS["Linear API Key"]="lin_api_[a-zA-Z0-9]{43}" | ||
| PATTERNS["Sentry DSN"]="https://[a-f0-9]{32}@[a-z0-9]+\\.ingest\\.sentry\\.io/[0-9]+" | ||
| PATTERNS["GitLab PAT"]="glpat-[a-zA-Z0-9_-]{20}" | ||
| PATTERNS["Doppler Token"]="dp\\.(pt|st|sa|ct|scim|audit)\\.[a-zA-Z0-9]{40,}" |
There was a problem hiding this comment.
Doppler service tokens include the config name between dp.st and the random token material (the official service-token docs show values shaped like dp.st.prd.xxxx), so this pattern only catches personal-style dp.pt.<secret> tokens and misses the documented production/CI form dp.st.<config>.<secret>. That leaves leaked service tokens in .claude/settings*.json or other scanned files unreported even though this change marks Doppler tokens as critical.
Useful? React with 👍 / 👎.
| (r"lin_api_[A-Za-z0-9]{43}", "Linear API key"), | ||
| (r"AIza[0-9A-Za-z_-]{35}", "Google API key"), | ||
| (r"glpat-[A-Za-z0-9_-]{20}", "GitLab personal access token"), | ||
| (r"dp\.(pt|st|sa|ct|scim|audit)\.[A-Za-z0-9]{40,}", "Doppler token"), |
There was a problem hiding this comment.
For inline command blocking, this has the same service-token gap: Doppler service tokens are shaped like dp.st.<config>.<secret> (for example the docs use dp.st.prd.xxxx), but the regex requires the secret material immediately after dp.st.. Inline commands such as export DOPPLER_TOKEN='dp.st.prd....' can therefore be approved and persisted to settings even though service tokens are the documented production path.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
script/security-credential-scan.sh (1)
219-230:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPromote Google API key findings to CRITICAL for strict-mode enforcement.
Line 83 detects
"Google API Key", but Lines 219-230 never promote it toCRITICAL. With--strict, a repo containing only a Google key can still exit 0, which undercuts the security gate.🔐 Suggested fix
if [[ "$pattern_name" == *"AWS"* ]] || \ + [[ "$pattern_name" == *"Google API Key"* ]] || \ [[ "$pattern_name" == *"GitHub Token"* ]] || \ [[ "$pattern_name" == *"Private Key"* ]] || \ [[ "$pattern_name" == *"OpenAI"* ]] || \As per coding guidelines,
**/*.{js,ts,jsx,tsx,py,java,go,rb,php,json,lock,txt,yaml,yml}: Fail on critical security vulnerabilities during Security Code Analysis.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@script/security-credential-scan.sh` around lines 219 - 230, The check that sets severity="CRITICAL" for discovered secrets omits the "Google API Key" pattern, so when pattern_name equals "Google API Key" it isn't promoted to CRITICAL and strict mode can miss-fail; update the condition that tests pattern_name (the long OR chain that currently checks "AWS", "GitHub Token", "Private Key", "OpenAI", "Anthropic", "Stripe", "Supabase", "Slack Token", "GitLab", "Doppler", "Database URL") to also include [[ "$pattern_name" == *"Google API Key"* ]] so that the "Google API Key" finding sets severity="CRITICAL" (the variable severity used later to determine exit behavior).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/hooks-command-safety.test.js`:
- Around line 153-155: The test 'should detect Doppler tokens' currently only
asserts the label text via expect(content).toContain('Doppler token'); update it
to assert the actual Doppler regex marker instead of just the label by changing
the assertion on the content variable to match the regex pattern (use
expect(content).toMatch(...) with the Doppler detection regex or the exact
marker string used in the scanner). Locate the test named "should detect Doppler
tokens" and replace the toContain check on content with a toMatch against the
canonical Doppler regex/marker used by the hook scanner so the test fails if the
regex is weakened.
---
Outside diff comments:
In `@script/security-credential-scan.sh`:
- Around line 219-230: The check that sets severity="CRITICAL" for discovered
secrets omits the "Google API Key" pattern, so when pattern_name equals "Google
API Key" it isn't promoted to CRITICAL and strict mode can miss-fail; update the
condition that tests pattern_name (the long OR chain that currently checks
"AWS", "GitHub Token", "Private Key", "OpenAI", "Anthropic", "Stripe",
"Supabase", "Slack Token", "GitLab", "Doppler", "Database URL") to also include
[[ "$pattern_name" == *"Google API Key"* ]] so that the "Google API Key" finding
sets severity="CRITICAL" (the variable severity used later to determine exit
behavior).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7c2e3c42-0e46-4c2b-b1ba-bd180d2084d7
📒 Files selected for processing (4)
.claude/hooks/block_inline_secrets.pyscript/security-credential-scan.shtest/hooks-command-safety.test.jstest/integration/security-scripts.bats
| test('should detect Doppler tokens', () => { | ||
| expect(content).toContain('Doppler token'); | ||
| }); |
There was a problem hiding this comment.
Assert the Doppler regex marker, not only the label text.
Line 154 validates "Doppler token" only. If the regex is accidentally weakened but the label stays, this test still passes.
💡 Suggested test hardening
test('should detect Doppler tokens', () => {
- expect(content).toContain('Doppler token');
+ expect(content).toContain('dp\\.(pt|st|sa|ct|scim|audit)\\.');
});🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/hooks-command-safety.test.js` around lines 153 - 155, The test 'should
detect Doppler tokens' currently only asserts the label text via
expect(content).toContain('Doppler token'); update it to assert the actual
Doppler regex marker instead of just the label by changing the assertion on the
content variable to match the regex pattern (use expect(content).toMatch(...)
with the Doppler detection regex or the exact marker string used in the
scanner). Locate the test named "should detect Doppler tokens" and replace the
toContain check on content with a toMatch against the canonical Doppler
regex/marker used by the hook scanner so the test fails if the regex is
weakened.
|
🎉 This PR is included in version 1.115.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Why
secret 検出の対象トークン種別に漏れがあった。scanner と inline-secret フックの両層に、これまで未対応だった GitLab / Doppler / Google のトークンを追加し、「混入を入口で止め（hook）、混入済みを scan で検出」する多層防御を揃える。
（#796 を #795 のスタックとして作成していたが、#795 がレビュー修正込みで先行マージされ base ブランチが消えたため、最新 main の上に cherry-pick し直した再作成版。#795 の quote-strip 修正は保持している。）
What
scanner (
security-credential-scan.sh)PATTERNSに GitLab PAT (glpat-…) と Doppler Token (dp.<type>.…) を追加し、両者を CRITICAL に分類hook (
block_inline_secrets.py)SECRET_PATTERNSに Google API key (AIza…) / GitLab PAT / Doppler Token を追加（scanner に既存だった Google を inline 側にも揃える）tests
security-scripts.bats:.claude設定内の GitLab/Doppler を検出するケース追加（トークンは GitHub push protection 回避のため実行時生成）hooks-command-safety.test.js: 3 種別のパターン存在アサーション追加doppler run/ 通常 commit は allowRisk
低。検出種別の追加のみ。既存の検出・FP 抑制・quote-strip ロジックは無変更。jest 116 / bats 18 green。
🤖 Generated with Claude Code
Summary by CodeRabbit