{"repo":"NousResearch/hermes-agent","public_id":"116149","display_label":"Case-insensitive credential env name security fix","summary":"These items address a security issue where credential environment variable names with different letter casing could bypass blocklist filtering and child-environment scrubbing. The work involves matching credential env names case-insensitively to close this bypass.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":116751,"merged_at":"2026-09-20T19:53:48+00:00"},"resolution":{"state":"resolved","by":"pr-116751"},"freshness":{"state":"verified","last_verified_at":"2026-09-20T19:53:48+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":1.0},"fix_edges":[{"issue_number":116149,"pr_number":116751,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-20T19:53:48+00:00"}],"members":[{"kind":"issue","number":116149,"title":"Case-variant credential env names bypass the provider blocklist and child-env scrub","url":null,"state":"closed"},{"kind":"pr","number":116150,"title":"fix(security): match credential env names case-insensitively","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"940c6109943a","number":0},{"kind":"pr","value":"#116751","number":116751},{"kind":"pr","value":"#116149","number":116149},{"kind":"pr","value":"#116150","number":116150}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":116177,"title":"fix(security): close case-variant credential env bypass","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"940c6109943a","number":0},{"kind":"pr","value":"#116751","number":116751},{"kind":"pr","value":"#116149","number":116149},{"kind":"pr","value":"#116150","number":116150}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":116751,"title":"fix(security): case-variant credential env names no longer bypass the passthrough blocklist and child-env scrub (#116149, salvage #116150)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_env_passthrough.py","tests/tools/test_local_env_blocklist.py","tools/env_passthrough.py","tools/environments/docker_egress.py","tools/environments/local.py","tools/environments/local_env_policy.py","tools/environments/remote_common.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}