Skip to content

[#17] target field is never redacted in reports/emails/Slack #1763

Description

@utksh1

reporting.py:_normalize_finding applies redact() to description/proof/confidence_reason but never to target; notification_service.py embeds finding.get('target') in subjects/Slack payloads without redact(). Internal hostnames/IPs/credentials embedded in target leak in every format.

Fix: apply redact() to target and walk evidence values with recursive redaction.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:backendBackend API, database, or service workpriority:highHigh-priority issuetype:securitySecurity work category bonus label

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions