@vellumai/cli 0.11.9-dev.202609081225.acf7958 → 0.11.9-dev.202609081317.37fcc19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/node_modules/@vellumai/local-mode/node_modules/@vellumai/service-contracts/src/__tests__/secret-detection.test.ts +2 -0
- package/node_modules/@vellumai/local-mode/node_modules/@vellumai/service-contracts/src/secret-detection.ts +7 -0
- package/node_modules/@vellumai/service-contracts/src/__tests__/secret-detection.test.ts +2 -0
- package/node_modules/@vellumai/service-contracts/src/secret-detection.ts +7 -0
- package/package.json +1 -1
|
@@ -38,6 +38,8 @@ const FIXTURES: Record<string, string> = {
|
|
|
38
38
|
"GitLab Token": `glpat-${filler(20)}`,
|
|
39
39
|
"Stripe Secret Key": `sk_live_${filler(24)}`,
|
|
40
40
|
"Stripe Restricted Key": `rk_live_${filler(24)}`,
|
|
41
|
+
"Link Access Token": `liwltoken_${filler(24)}`,
|
|
42
|
+
"Link Refresh Token": `liwlrefresh_${filler(24)}`,
|
|
41
43
|
"Slack Bot Token": `xoxb-1234567890-1234567890-${filler(24)}`,
|
|
42
44
|
"Slack User Token": `xoxp-1234567890-1234567890-1234567890-${"0123456789abcdef".repeat(2)}`,
|
|
43
45
|
"Slack App Token": "xapp-1-abc123-4567-defghij890",
|
|
@@ -143,6 +143,13 @@ export const PREFIX_PATTERNS: SecretPrefixPattern[] = [
|
|
|
143
143
|
// -- Stripe --
|
|
144
144
|
{ label: "Stripe Secret Key", regex: /sk_live_[A-Za-z0-9]{24,}/ },
|
|
145
145
|
{ label: "Stripe Restricted Key", regex: /rk_live_[A-Za-z0-9]{24,}/ },
|
|
146
|
+
// Link (Stripe's wallet) issues prefixed OAuth tokens rather than opaque
|
|
147
|
+
// ones, and its own docs tell users to export the access token as
|
|
148
|
+
// LINK_ACCESS_TOKEN to drive link-cli, so these do get pasted by hand. A
|
|
149
|
+
// leaked one can spend from the wallet. The `lwlpk_` client id is public
|
|
150
|
+
// (it ships in the CLI bundle) and is deliberately not matched here.
|
|
151
|
+
{ label: "Link Access Token", regex: /liwltoken_[A-Za-z0-9]{16,}/ },
|
|
152
|
+
{ label: "Link Refresh Token", regex: /liwlrefresh_[A-Za-z0-9]{16,}/ },
|
|
146
153
|
|
|
147
154
|
// -- Slack --
|
|
148
155
|
{
|
|
@@ -38,6 +38,8 @@ const FIXTURES: Record<string, string> = {
|
|
|
38
38
|
"GitLab Token": `glpat-${filler(20)}`,
|
|
39
39
|
"Stripe Secret Key": `sk_live_${filler(24)}`,
|
|
40
40
|
"Stripe Restricted Key": `rk_live_${filler(24)}`,
|
|
41
|
+
"Link Access Token": `liwltoken_${filler(24)}`,
|
|
42
|
+
"Link Refresh Token": `liwlrefresh_${filler(24)}`,
|
|
41
43
|
"Slack Bot Token": `xoxb-1234567890-1234567890-${filler(24)}`,
|
|
42
44
|
"Slack User Token": `xoxp-1234567890-1234567890-1234567890-${"0123456789abcdef".repeat(2)}`,
|
|
43
45
|
"Slack App Token": "xapp-1-abc123-4567-defghij890",
|
|
@@ -143,6 +143,13 @@ export const PREFIX_PATTERNS: SecretPrefixPattern[] = [
|
|
|
143
143
|
// -- Stripe --
|
|
144
144
|
{ label: "Stripe Secret Key", regex: /sk_live_[A-Za-z0-9]{24,}/ },
|
|
145
145
|
{ label: "Stripe Restricted Key", regex: /rk_live_[A-Za-z0-9]{24,}/ },
|
|
146
|
+
// Link (Stripe's wallet) issues prefixed OAuth tokens rather than opaque
|
|
147
|
+
// ones, and its own docs tell users to export the access token as
|
|
148
|
+
// LINK_ACCESS_TOKEN to drive link-cli, so these do get pasted by hand. A
|
|
149
|
+
// leaked one can spend from the wallet. The `lwlpk_` client id is public
|
|
150
|
+
// (it ships in the CLI bundle) and is deliberately not matched here.
|
|
151
|
+
{ label: "Link Access Token", regex: /liwltoken_[A-Za-z0-9]{16,}/ },
|
|
152
|
+
{ label: "Link Refresh Token", regex: /liwlrefresh_[A-Za-z0-9]{16,}/ },
|
|
146
153
|
|
|
147
154
|
// -- Slack --
|
|
148
155
|
{
|