Security audit
Security checks for vulnerabilities and agentic risk
This release checker can approve content containing secrets and expose files outside the selected folder despite its stated safeguards.
Use an isolated release copy without symlinks and treat reports as sensitive. Require containment checks, output redaction, corrected exemptions, and input validation before relying on this tool as a publication gate. Independently check releases for secrets; a successful result currently provides unreliable assurance. All bundled files were inspected, and the evidence supports implementation flaws rather than intentional theft.
scripts/check_release.pyFile symlinks allow scanning credentials outside the authorized target
Credential values outside the authorized artifact can be disclosed in the scan report or agent conversation. Network exfiltration or attacker access to that output is not established.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import sys
import zipfile
TEXT_EXTS = {'.md', '.py', '.json', '.txt', '.yml', '.yaml', '.html', '.csv', '.xml', '.ini', '.cfg', '.env'}
BIN_EXTS = {'.png', '.jpg', '.jpeg', '.gif', '.webp', '.ico', '.pdf', '.docx', '.xlsx', '.pptx', '.zip'}
# ============ 四层检查模式 ============
The brand exemption examines the surrounding snippet and can exempt any finding type, including credentials, merely because the brand appears nearby. Because the keyword check includes the brand itself, the additional context requirement is effectively automatic; an attacker can place the brand beside sensitive data to remove it from real_hits and potentially obtain a successful release-gate exit code. This is particularly dangerous in a tool intended to prevent confidential information from being published.
scan_text passes the entire surrounding snippet to is_false_positive, so a nearby allowlisted value such as 127.0.0.1 or 11434 suppresses an otherwise valid secret finding. Substring matching also allows an allowlisted sequence inside a longer sensitive value to suppress that value. In a publication gate, these bypasses can produce a clean result while credentials or personal information remain in the release.