{"repo":"NousResearch/hermes-agent","public_id":"116221","display_label":"False positive: env-var name mistaken for hardcoded secret","summary":"These issues and PRs address a false positive where a string constant holding the *name* of an environment variable was incorrectly flagged as a hardcoded secret, blocking plugin installation. The fixes aim to distinguish env-var name literals from actual embedded credentials.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":116875,"merged_at":"2026-09-20T18:30:03+00:00"},"resolution":{"state":"resolved","by":"pr-116875"},"freshness":{"state":"verified","last_verified_at":"2026-09-20T18:30:03+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":116221,"pr_number":116875,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-20T18:30:03+00:00"}],"members":[{"kind":"issue","number":116221,"title":"plugin_guard: hardcoded_secret false positive on constants holding the NAME of a credential env var (blocks install, --force cannot override)","url":null,"state":"closed"},{"kind":"pr","number":116231,"title":"fix(skills): an env-var NAME constant is not an embedded credential","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"3d14b20de9d2","number":0},{"kind":"pr","value":"#116875","number":116875},{"kind":"pr","value":"#116221","number":116221},{"kind":"pr","value":"#116231","number":116231}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":116875,"title":"fix(guard): an env-var NAME constant no longer blocks a plugin install as a hardcoded secret (#116221, salvage #116231)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_plugin_guard.py","tests/tools/test_threat_patterns.py","tools/plugin_guard.py","tools/skills_guard.py","tools/threat_patterns.py"]},{"kind":"pr","number":117517,"title":"fix(plugin-guard): treat an env-var NAME literal as public, not a hardcoded secret (#116221)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"1b50e99a47","number":0},{"kind":"pr","value":"#116221","number":116221},{"kind":"pr","value":"#116875","number":116875},{"kind":"pr","value":"#116231","number":116231}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}