open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity

docs(egress): the summary row was hand-totalled, and the caveat was measurable

Browse source 
Three corrections to a document whose measurements were right.

The "shapes commons reports and the guard is silent on" row said 6 across 4
commons entries. Re-derived from the differential rather than from the table:
7 witnesses across 5 entries. The old figure collapsed the two webhook hosts
into one row while keeping the two GitHub prefixes as two, so it was
inconsistent with itself, and it dropped GitHub Token from the entry count
even though two of its five prefixes are exactly what the guard misses. The
table now runs one row per witness and says why counting either way alone
misleads.

The mapping row for connection strings said "minus one scheme". The section
below it already said the right thing: commons catches mongodb:// and misses
the SRV form. Aligned.

The "seed B was read at a commit the guard did not port from" caveat is gone,
replaced by the measurement that dissolves it. knowledge/secrets-patterns.md
has one commit at or before 47905da - f153f96, 2026-04-08 - and the guard's
output.py was first committed 2026-07-04. The seed had been still for three
months when the port was written. The 5 real drifts are guard-side by
measurement now, not by inference.

Neither coord message carried the bad count, so nothing needs re-sending.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UFforUbBA7GnUYijg78kpK
This commit is contained in:
Kjell Tore Guttormsen 2026-08-13 22:22:29 +02:00
commit 4a6f6ffc16
1 changed files with 24 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

36
docs/secret-egress-divergence.md
View file

@ -54,7 +54,7 @@ guard ported the other one.
| — of the 9 remaining, behaviourally real | differential match comparison | **5** — 4 connection strings, 1 capture-group change |
| commons vs guard, byte-identical patterns | unescape both sides' `\/` and `\"`, compare source + flags | **2/19** |
| Differential probe corpus | one witness per guard id, plus each side's exclusive shapes and the semantics witness | 36 probes |
| Shapes commons reports and the guard is silent on | differential | **6** (across 4 commons entries) |
| Shapes commons reports and the guard is silent on | differential | **7 witnesses, across 5 commons entries** |
| Shapes the guard reports and commons is silent on | differential | **3** |
| Match-semantics divergence | one witness matching two entries on both sides | **1 label vs 2 labels** |
@ -120,7 +120,7 @@ two regexes side by side.
| 13 `Slack/Discord Webhook URL` | — | **guard silent** |
| 14 `Generic credential assignment` | `generic-api-key`, `config-password`, `config-secret` | 1:3 |
| 15 `Authorization header with token` | `bearer-token` (+ `jwt-token`, see semantics) | 1:1 |
| 16 `Database connection string` | `postgres-connstr`, `mysql-connstr`, `redis-connstr` | 1:3, **minus one scheme** |
| 16 `Database connection string` | `postgres-connstr`, `mysql-connstr`, `redis-connstr` | 1:3, **minus the MongoDB SRV form** |
| 17 `OpenAI Legacy API Key` | `openai-api-key-legacy` | 1:1, **byte-identical** |
| 18 `JWT (three-part token)` | `jwt-token` | 1:1 |
@ -137,19 +137,27 @@ alternative, exact length. The corpus witnessed only the `AccountKey` shape, whe
## What each side misses that the other catches
**Commons reports, guard silent — 6 shapes across 4 entries:**
**Commons reports, guard silent — 7 witnesses across 5 commons entries:**
| Shape | commons entry | Why the guard is silent |
| Witness shape | commons entry | Why the guard is silent |
| --- | --- | --- |
| `ghu_` prefixed token | `GitHub Token` | guard ported `ghp`/`gho`/`ghs`; no id for `ghu` |
| `ghr_` prefixed token | `GitHub Token` | same |
| `aws_secret_access_key = <40 chars>` | `AWS Secret Access Key` | seed B has `aws-secret-access-key`; guard did not port it |
| `Ocp-Apim-Subscription-Key` assignment | `Azure AI Services Key` | absent from seed B entirely |
| `JWT_SECRET` assignment | `JWT Secret` | absent from seed B entirely |
| Slack / Discord webhook URL | `Slack/Discord Webhook URL` | absent from seed B entirely |
| Slack webhook URL | `Slack/Discord Webhook URL` | absent from seed B entirely |
| Discord webhook URL | `Slack/Discord Webhook URL` | same |
The last three are the sharper finding: they are not entries the guard declined to port, they
are entries **seed B does not have**. Seed A has three shapes seed B never carried.
One row is one witness, so two commons entries appear twice: `GitHub Token` covers five
prefixes behind one name, and `Slack/Discord Webhook URL` covers two hosts. Counting rows
rather than entries would overstate how much of commons the guard is missing, and counting
entries rather than rows would hide that `GitHub Token` is only *partly* uncovered — its
`ghp`/`gho`/`ghs` prefixes map onto three guard ids just fine.
Three of the seven are the sharper finding: the `Ocp-Apim-Subscription-Key`, `JWT_SECRET` and
webhook shapes are not entries the guard declined to port, they are entries **seed B does not
have**. Seed A carries three shapes seed B never did.
**Guard reports, commons silent — 3 shapes:**
@ -243,11 +251,15 @@ file granularity.
whether two tables is intentional (one engine-consumed, one agent-consumed) or whether one
supersedes the other.
- **It does not measure seed A's current state.** Commons' fidelity to seed A was verified at
commit `47905da` and this document adds nothing to that. Seed B was read at the same commit,
which is a convenient shared coordinate and **not** the commit the guard ported from — the
guard's port predates it. A seed-B entry that moved between the guard's port and `47905da`
would appear here as guard drift. The 5 real drifts are all explained by the guard's own
module comments, which makes that unlikely, not impossible.
commit `47905da` and this document adds nothing to that.
*(Seed B was read at the same commit, which is a shared coordinate and not the commit the
guard ported from. That was going to be a caveat — a seed-B entry that moved between the
guard's port and `47905da` would show up here as guard drift. It is dissolved by measurement
instead: `git log -- knowledge/secrets-patterns.md` in a deepened mirror returns exactly one
commit at or before `47905da`, `f153f96`, dated 2026-04-08, and the guard's `output.py` was
first committed 2026-07-04. The seed had been still for three months when the port was
written and has not moved since. Reading it at `47905da` reads what the guard ported from,
so the 5 real drifts are guard-side by measurement rather than by inference.)*
- **It does not compare coverage.** The probe corpus has one witness per guard id plus each
side's exclusive shapes — 36 inputs. It is built to expose membership and semantics, not to
estimate recall. `SharedAccessKey=` and `sig=` Azure shapes, and seed B's 8 unported ids,