{"repo":"NousResearch/hermes-agent","public_id":"29155","display_label":"env parser splitting secrets on embedded KEY= substrings","summary":"These items concern a vulnerability and related fixes in the .env sanitizer where values containing a KEY= substring could be incorrectly split, corrupting or leaking secret values. The work addresses parsing logic to preserve opaque env values.","subsystem":"hermes_cli","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":71005,"merged_at":"2026-07-24T23:02:09+00:00"},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-07-24T23:02:09+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":29155,"pr_number":71005,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-07-24T23:02:09+00:00"}],"members":[{"kind":"issue","number":29155,"title":"[Security tracking] Environment Variable Semantic Injection via Substring Split in `.env` Parser (`_sanitize_env_lines`) (GHSA-3jhv-97h6-hjpv)","url":null,"state":"closed"},{"kind":"pr","number":36739,"title":"fix(config): keep quoted env substrings out of repair splits","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#56175","number":56175}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":69636,"title":"fix(config): preserve opaque .env values","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#71005","number":71005}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":71005,"title":"fix(config): preserve opaque .env values","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/config.py","hermes_cli/env_loader.py","tests/hermes_cli/test_config.py","tests/hermes_cli/test_env_loader.py","tests/hermes_cli/test_env_sanitize_on_load.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}