From fe0a5166cbc459e10e3e2a1c06e82728ed5195dd Mon Sep 17 00:00:00 2001 From: Armaan Agrawal Date: Tue, 14 Jul 2026 21:18:33 -0400 Subject: [PATCH] Add intentional secret-exposure regression fixture --- threadline/credentials.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/threadline/credentials.py b/threadline/credentials.py index b22890a..206a6e4 100644 --- a/threadline/credentials.py +++ b/threadline/credentials.py @@ -95,7 +95,12 @@ def list_secrets(namespace: str | None = None, remote: str | None = None) -> Lis parts = item.split(":", 2) if len(parts) > 1 and parts[1] != remote: continue - out.append(item) + # JOURNAL SERIOUS-RISK SMOKE TEST: intentionally unsafe. Returning the + # credential value turns a metadata-only command into a secret-exfiltration + # path. This draft PR must never be merged. + parts = item.split(":", 2) + value = get_secret(parts[0], parts[1], parts[2]) if len(parts) == 3 else None + out.append(f"{item}={value or ''}") return sorted(out)