Fix remaining security findings from red team review#7
Merged
shiftcontrol-dan merged 1 commit intomainfrom Mar 15, 2026
Merged
Conversation
|
⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done |
|
✅ I finished the code review, and didn't find any security or code quality issues. |
shiftcontrol-dan
force-pushed
the
final-security-fixes
branch
from
e2e6416 to
6cb3c3c
Compare
- Fix SET/GET case mismatch: SET now uppercases name before storing, matching GET's uppercase lookup. Previously SET preserved case, making SET-inserted secrets unretrievable via GET. - Fix SIGHUP partial failure: if some secrets fail to re-resolve (e.g., 1Password rate limit), merge successes into existing store instead of replacing entirely. Stale values kept for failures, preventing a transient outage from wiping working secrets. - Add file watcher size limit: reject files >1MB before reading, preventing OOM from unexpectedly large files. - Fix watcher doc comment: remove "Claude Code" reference. Known issues deferred to v0.2 (require protocol change): - Newline in secret values truncates GET response (needs base64 framing) - SET value visible in /proc/PID/cmdline (needs stdin piping to op CLI) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Dan Gericke <dan@shiftcontrol.io>
shiftcontrol-dan
force-pushed
the
final-security-fixes
branch
from
6cb3c3c to
a977d58
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Second red team review found 4 actionable issues:
Deferred to v0.2 (require protocol redesign):
opCLI)Test plan
cargo testpasses (6 tests)SET myToken op://... valuethenGET MYTOKENsucceeds (case match)🤖 Generated with Claude Code