fix: hide the Splunk Cloud stack name at untrusted output boundaries - #83
Open
JacobPEvans-personal wants to merge 2 commits into
Open
fix: hide the Splunk Cloud stack name at untrusted output boundaries#83JacobPEvans-personal wants to merge 2 commits into
JacobPEvans-personal wants to merge 2 commits into
Conversation
Opt-in via VCT_SPLUNK_REDACT_TARGET=1: hides the Cloud stack label in prompts, JSON metadata, and transport error text, without touching the audit log (which still records the real host). `splunk inspect` reports `stack_configured: bool` instead of echoing the stack name. The Splunk Cloud Read Canary workflow sets the variable and scans its own pytest output for a leaked target or credential before publishing anything.
This was referenced Aug 18, 2026
Draft
Delete .github/scripts/scan-cloud-ci-leaks.py and its invocation from run-cloud-suite.sh, and drop the corresponding mentions in cloud-read.yml and CHANGELOG.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
public_target()andredact_exception_text()toutils/redact.py. Opt-in viaVCT_SPLUNK_REDACT_TARGET=1: hides a Splunk Cloud stack label in prompts, JSON metadata, and transport error text. The audit log is unaffected and always records the real host.splunk inspectreportsstack_configured: boolinstead of echoing the Cloud stack name..github/scripts/scan-cloud-ci-leaks.py, which fails a CI step if its output artifacts still contain a Cloud stack name or a live auth value, and.github/scripts/run-cloud-suite.sh, a shared runner (pytest + tee + scan + exit) used by theSplunk Cloud Read Canaryworkflow.Test plan
ruff check .,ruff format --check .,pyright,pytest(1055 passed) all green locallypre-commit run --all-filesgreentests/unit/test_public_target.pycovers the opt-in redaction, port preservation, ACS path redaction, and idempotencytest_acs.py::test_inspect_reports_deduced_cloudupdated forstack_configured