StackGuardian / StackGuardian/tirith
feat(terraform_plan): sensitivity awareness — `before_sensitive` / `after_sensitive`
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- Python
- Stars
- 165
- Forks
- 42
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 11
Description
Plans carry sensitivity maps; expose them so "anything matching a credential pattern must be marked
sensitive" is writable — the correct version of a secrets regex over attributes someone remembered
to name. Also: no sensitive value in an output, none written to a resource that logs.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by locating the Terraform plan parsing and policy evaluation paths that handle before_sensitive and after_sensitive maps; done means sensitivity data can be used in credential-pattern checks and sensitive values are excluded from outputs and logging resources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, terraform
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 38/100