Files
gstack/lib
Garry Tanandcapy-ai[bot] 76e2d3f987 Catch secrets in files git treats as binary before they are pushed (GST-2195) (#4243)
* Scan files git calls binary for secrets before push and in pregate (GST-2195)

A NUL byte, UTF-16 text or a -diff attribute made git print 'Binary files differ', so a token in that file passed pregate's secrets check and the pre-push hook. Both diffs now use --text and read such files through scannableText, keeping only credential findings; pregate's secrets check also fails closed when its merge-base diff does not finish.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Find tokens in UTF-16 text that is mostly Cyrillic or CJK, and note the size limit for binaries

Review-Finding: p1/red-team#1 reader=red-team
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Read each line of a binary file both plainly and as UTF-16, so a nearby byte cannot hide a token

Review-Finding: p2/specialist-batched#1 reader=specialist-batched
Review-Finding: p2/red-team#1 reader=red-team
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Keep tokens beside CJK characters in UTF-16 files whole, and parse large added diffs in linear time

Review-Finding: p2v/outside-voice#1 reader=outside-voice
Review-Finding: p2v/targeted#1 reader=targeted
Review-Finding: p2v/outside-voice#2 reader=outside-voice
Review-Finding: p2v/adversarial-native#1 reader=adversarial-native
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Split two long sentences in the changelog entry for binary-file scanning

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Describe how the secret check reads binary files, its size limits and its new pass line

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Say which UTF-16 layouts the binary-file secret scan does not catch yet

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
2026-11-09 22:52:26 +00:00
..