[security] Token can leak unmasked into git failure logs (URL-encoded credential) #6

New issue

Closed

opened 2026-06-23 20:14:55 +00:00 by stephen · 0 comments

stephen commented

2026-06-23 20:14:55 +00:00

Owner

Autonomous security audit finding (HIGH).

The token is embedded in the push URL (src/main.js:146-154). core.setSecret masks the raw token, but git's stderr echoes the URL-encoded credential, which doesn't match the registered mask — so on a push failure (setFailed ~:356) the encoded token can appear in logs.

Fix: use http.extraheader (Authorization) or GIT_ASKPASS and never embed the credential in the remote URL.

Autonomous security audit finding (HIGH). The token is embedded in the push URL (`src/main.js:146-154`). `core.setSecret` masks the raw token, but git's stderr echoes the URL-**encoded** credential, which doesn't match the registered mask — so on a push failure (`setFailed` ~:356) the encoded token can appear in logs. Fix: use `http.extraheader` (Authorization) or `GIT_ASKPASS` and never embed the credential in the remote URL.

stephen referenced this issue from a pull request that will close it,

2026-06-23 20:47:21 +00:00

[security] Stop embedding token in push URL (use http.extraheader) #7

stephen closed this issue

2026-06-23 22:11:28 +00:00