From d493c4b25d20e06be555434b6b89745d005a59c0 Mon Sep 17 00:00:00 2001 From: jaso0n0818 Date: Thu, 25 Jun 2026 04:26:29 +0000 Subject: [PATCH] feat(signals): extend public redaction for /var and Program Files paths Expand the shared PUBLIC_UNSAFE_PATTERN so maintainer-facing copy cannot leak common Linux /var or Windows Program Files filesystem paths (#542). Co-authored-by: Cursor --- src/signals/redaction.ts | 5 ++++- test/unit/redaction.test.ts | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/signals/redaction.ts b/src/signals/redaction.ts index 7b6e7af8a5..adc201617d 100644 --- a/src/signals/redaction.ts +++ b/src/signals/redaction.ts @@ -19,7 +19,10 @@ // intentionally NOT collapsed onto `PUBLIC_UNSAFE_TERMS`. export const PUBLIC_UNSAFE_TERMS = String.raw`reward\w*|score\w*|wallet|hotkey|coldkey|mnemonic|farming|payout|ranking|raw[-_\s]?trust|trust[-_\s]?score|private[-_\s]?reviewability|reviewability`; -export const PUBLIC_UNSAFE_PATTERN = new RegExp(String.raw`\b(${PUBLIC_UNSAFE_TERMS})\b|/Users/|/home/|/tmp/|[A-Z]:[\\/]Users[\\/]`, "i"); +export const PUBLIC_UNSAFE_PATTERN = new RegExp( + String.raw`\b(${PUBLIC_UNSAFE_TERMS})\b|/Users/|/home/|/tmp/|/var/|[A-Z]:[\\/]Users[\\/]|[A-Z]:[\\/]Program Files[\\/]`, + "i", +); /** True iff `text` contains nothing that must stay private — i.e. it is safe to surface on a public GitHub surface. */ export function isPublicSafeText(text: string): boolean { diff --git a/test/unit/redaction.test.ts b/test/unit/redaction.test.ts index 6be22518b1..f16f5bb848 100644 --- a/test/unit/redaction.test.ts +++ b/test/unit/redaction.test.ts @@ -33,8 +33,10 @@ describe("isPublicSafeText (#542 shared public/private boundary)", () => { expect(isPublicSafeText("/Users/alice/project")).toBe(false); expect(isPublicSafeText("/home/bob/repo")).toBe(false); expect(isPublicSafeText("/tmp/scratch")).toBe(false); + expect(isPublicSafeText("/var/log/app.log")).toBe(false); expect(isPublicSafeText("C:\\Users\\carol\\repo")).toBe(false); expect(isPublicSafeText("C:/Users/carol/repo")).toBe(false); + expect(isPublicSafeText("C:\\Program Files\\Vendor\\app")).toBe(false); }); it("is case-insensitive", () => {