Cairn

Extending credential redaction to state.db and OAuth tokens

NousResearch/hermes-agent · cluster 39654 · agent

Data as of

4 open items. Fix attempted, not merged.

The short answer

3open issues
1open PR
6items grouped
Known?
Yes. 6 related items grouped here, 0 issues already closed.
Fix event
No fix has been merged to main. 2 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
3 issues and 1 PR.

These issues and pull requests address gaps in secret redaction coverage, specifically adding Google OAuth token prefixes (ya29./1//) to the scrubber and applying redaction at the state.db persistence boundary, which was previously missed. Tool output file dumps, compaction blocks, and DB URIs are also noted as related redaction gaps.

Open issues3

  • Issue#39654Hardening: extend secret redaction to state.db persistence + add Google OAuth (ya29./1//) prefixes
  • Issue#43666Redaction gaps at the persistence boundary: tool output file dumps, compaction blocks, DB URIs (split from #43083)
  • Issue#54027Credential redaction not applied to state.db session store (only logs + optional JSON snapshots)

Open PRs1

  • PR#54038fix(state): redact credentials in state.db before INSERT (#54027)

2 PRs closed without merging

From the close comments: duplicate 1 · other 1

  • #39697 fix(security): redact Google OAuth token prefixes (ya29., 1//) in secret scrubber · other
  • #40092 fix(security): add Google OAuth ya29./1// prefixes to secret redactor · duplicate → #39697
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.27: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
0
Attempts
2 PRs closed without merging

For your agent

The same facts, typed.

cluster/39654.json
cluster/39654.md