{"repo":"NousResearch/hermes-agent","public_id":"30962","display_label":"Prevent redacted secret placeholders from being persisted","summary":"These issues and fixes address a shared problem: redacted credential placeholders (e.g. masked secret values) could be accidentally written to files or saved to config, potentially corrupting secrets or breaking connectivity. The work focuses on adding validation to reject such placeholders at input boundaries.","subsystem":"agent","counts":{"members":6,"open_issues":2,"open_issues_distinct":2,"open_prs":3,"closed_issues":0,"merged_prs":0,"attempt_prs":4},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.29066666666666663},"fix_edges":[],"members":[{"kind":"issue","number":30962,"title":"Patch tool can fail or corrupt secrets when old_string is copied from redacted file output","url":null,"state":"open"},{"kind":"issue","number":42727,"title":"[Bug]: agent-led self-configuration can persist redacted credentials and break gateway connectivity","url":null,"state":"open"},{"kind":"pr","number":31003,"title":"fix(tools): reject redacted-secret placeholders in write_file / patch input (#30962)","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"de928bccd","number":0},{"kind":"pr","value":"#35519","number":35519}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":42746,"title":"fix(config): reject redacted credential placeholders","url":null,"state":"closed","close_reason":{"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":42748,"title":"fix(config): refuse to persist redacted secret placeholders via config set","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#42746","number":42746}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":70454,"title":"fix(config): reject redacted credential placeholders","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}