getappmap / getappmap/appmap-js
secret-in-log is unreliable against sanitized gold traces
Open
@kgilpin is already working on this.
Since Sep 8, 2026.
- Dominant language
- TypeScript
- Stars
- 53
- Forks
- 18
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 8
Description
sanitize replaces all values with sequentially numbered tokens like <v1337>. When by coincidence in two different appmaps the same token is masking a secret in one and a log output in another, when using the golden traces skill I've seen the scanner erronously flag this as secret-in-log issue even though the tokens correspond to different strings.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.