Files
graphify/tests
0xkaushik-aiandClaude Sonnet 5.5 44bd623a2e fix(extract): redact credential-shaped text from rationale labels
Docstrings and `# WHY:`/`# NOTE:` comments become rationale node labels,
which are persisted verbatim to graph.json, graph.html, GRAPH_REPORT.md and
the AST cache. A token pasted into a comment therefore ended up in the
artifacts the README tells users to commit and share.

Add security.redact_secrets() (shape-based: vendor-prefixed tokens, PEM
private-key headers, JWTs, URL passwords) and apply it in
_shorten_rationale_label(), before truncation so a cut can't leave a partial
token. That helper is shared by the Python and JS/TS rationale extractors.

Related to #2781 (document text sent to LLM backends unredacted); this
covers only the comment/docstring -> graph path.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-20 10:53:04 +01:00
..