121 releases 129 tags

RSS feed

• v0.39.2 cff4215765

  Compare

  0.39.2 — the credential in the file nothing scans Stable

  joeyr released this 2026-08-24 09:03:20 -05:00 | 90 commits to main since this release

  The credential was still in the one file nothing scans. 0.39.0 removed the real
  Canvas token from tests/test_feeds.py and, in the same commit, left it sitting in
  tests/test_no_pii.py — in the docstring of _looks_like_a_token, the helper written to
  catch exactly that shape. It survived two releases and every green run of the guard that
  exists to find it.

  Security

  • tests/test_no_pii.py no longer contains the token. The file exempts itself from
    _tracked_text_files by necessity — it has to carry examples of what a leak looks like,
    or its own detectors could not be proved — which makes it the one file in the repo where
    a pasted literal is checked by nothing at all. Every example now refers to
    _INVENTED_TOKEN: one literal, in one place, on a line whose comment says what it is.

  • A one-character mutation is not a redaction. The assertion's copy had been changed
    from …xd5… to …Xd5… and treated as invented. That is the credential with a typo in
    it, and trying both costs an attacker nothing. The replacement shares only the shape —
    upper and lower and digits together — which is all the case-mixing rule needs to be
    exercised by.

  Note

  • The value is also being removed from published history, along with the institution
    hostnames that 0.39.0 and 0.39.1 took out of the working tree. Rewriting a public history
    does not un-publish anything that was already fetched: the feed still has to be reset
    in Canvas, and until it is, the URL is live regardless of what this repo contains.

  • No runtime code changes. mcp_gateway/ is untouched apart from the version constant.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads