flecto 4.3.0 → 4.4.1

package/CHANGELOG.md

@@ -7,6 +7,47 @@ The format is based on [Keep a Changelog], and this project adheres to
 
 ## [Unreleased]
 
+## [4.4.1] - 2026-10-11
+
+### Fixed
+
+- **A secret word anywhere above a value no longer makes it a "secret"**
+  ([#248]). Key-name matching tested the whole path, inside longer words too,
+  so it masked and flagged `capabilities.drop[0]` under `redisSecretInit`,
+  `matchLabels.app` under `apiKey`, `tokenizer.flavor`, `server-tokens:
+  "false"`, and the `type`/`description` of every CRD schema property named
+  `clientSecret`. Measured over every YAML leaf in 24 real repositories, 1,102
+  leaves were flagged; now 222, and none that were not flagged before.
+
+  A key now names a credential when the word is whole (after camelCase and
+  punctuation splitting, or ending a compound like `DBPASSWORD`) and its last
+  word is not metadata (`secretName`, `createSecretJob`, `tokenTTL`). A leaf
+  is a secret when its own key names one, or an ancestor does with no
+  structure or metadata key in between (`secrets.prod.db` yes;
+  `apiKey.selector.matchLabels.app` no), or it sits in a credential's
+  `data`/`stringData` under any name. `key` and `id` stay credential words
+  (`apiKey`, Vault `secret_id`). Display masking, the snapshot store, and
+  `secret-key-changed` all use this rule; the value detector still runs on
+  every value regardless.
+
+[#248]: https://github.com/myselfsiddharth/Flecto/issues/248
+
+## [4.4.0] - 2026-10-05
+
+### Changed
+
+- **Flag lists diff by flag name, so removing one arg is one removal**
+  ([#238]). A real pull request that removed the first of eight container
+  `args` read as 7 `changed` and 1 `removed`, each pairing two unrelated flags.
+  It now reads as `removed args["--keytoolPath"]`. A list counts when every item
+  is `-x`, `--name` or `--name=value` with unique names; a repeated `--set`,
+  `["--port", "8080"]`, and `["-c", "echo hi"]` keep the position diff, and
+  `--no-array-id` turns it off. Paths change from `args[0]` to
+  `args["--name"]` for these lists. No built-in pack rule matches an `args`
+  index.
+
+[#238]: https://github.com/myselfsiddharth/Flecto/issues/238
+
 ## [4.3.0] - 2026-10-05
 
 ### Fixed
@@ -315,6 +356,19 @@ for what was wrong.
   untrusted-PR threat model. `--plugins` must be absolute paths. See
   [docs/editor.md](docs/editor.md).
 
+- **`flecto-drift`: compare a declared config file against what is actually
+  running** ([#144]). A **separate binary**, deliberately: every other Flecto
+  command authenticates to nothing, and reading live state cannot keep that
+  promise, so it does not share an entry point with the tool that can. `flecto
+  ci` cannot reach it and installing Flecto does not enable it.
+  It holds **no credentials** — Kubernetes and SSM are read through `kubectl`
+  and `aws`, which you have already authenticated, so Flecto inherits exactly
+  what those are entitled to. Read-only is structural: argv is built from a
+  fixed verb allowlist and nothing from the URI can reach it as a flag. Values
+  from a secret store are compared **by shape** (length and digest), never by
+  value, with no flag to change that; SSM is read without `--with-decryption`.
+  Terraform state exposes only `outputs`. See [docs/drift.md](docs/drift.md).
+
 ### Security
 
 - **BREAKING: `snapshotRef` declared in `.flectorc` is refused** ([#121]). The
@@ -360,20 +414,6 @@ for what was wrong.
   are cached and shared across every file in a run, and a `g` regex carries a
   mutable `lastIndex` that `.test()` advances, so such a rule matched every
   other value it saw.
-### Added
-
-- **`flecto-drift`: compare a declared config file against what is actually
-  running** ([#144]). A **separate binary**, deliberately: every other Flecto
-  command authenticates to nothing, and reading live state cannot keep that
-  promise, so it does not share an entry point with the tool that can. `flecto
-  ci` cannot reach it and installing Flecto does not enable it.
-  It holds **no credentials** — Kubernetes and SSM are read through `kubectl`
-  and `aws`, which you have already authenticated, so Flecto inherits exactly
-  what those are entitled to. Read-only is structural: argv is built from a
-  fixed verb allowlist and nothing from the URI can reach it as a flag. Values
-  from a secret store are compared **by shape** (length and digest), never by
-  value, with no flag to change that; SSM is read without `--with-decryption`.
-  Terraform state exposes only `outputs`. See [docs/drift.md](docs/drift.md).
 
 ### Fixed
 
@@ -489,6 +529,31 @@ for what was wrong.
   publish recommendation are in
   [`docs/ghsa-wq8m-fc3q-8m5x-2x.md`](docs/ghsa-wq8m-fc3q-8m5x-2x.md).
 
+- **Two denial-of-service vectors fixed, found while resuming the 3.0 security
+  review** ([#121]). (1) Secret detection (`src/secrets.js`), which runs on every
+  changed string value under the `default` pack, had two `O(n²)` regexes — the
+  PEM private-key and URL-credential patterns — so a single ~500 KB value in a
+  pull request could hang the CI job. Both are now linear; 1 MB scans in under a
+  second, and detection of real (including unterminated) keys is unchanged. (2) A
+  YAML alias bomb ("billion laughs") — a few hundred bytes of nested aliases that
+  `normalizeParsedValue` expanded into an exponentially large tree — now fails
+  fast against a node budget instead of exhausting memory. Regression tests for
+  both in `test/security.test.js`. The review's findings and its "checked, solid"
+  list are recorded in [docs/security-review.md](docs/security-review.md); a
+  residual limitation (attacker-supplied regexes in custom packs, which Node
+  cannot time out) is noted in [SECURITY.md](SECURITY.md).
+
+- **Terraform plan JSON is refused by every command except `flecto plan`.**
+  Terraform's `before_sensitive` / `after_sensitive` redaction is applied only by
+  `flecto plan`; a plan file is ordinary JSON, so `ci`, `watch`, `compare`,
+  `report`, and snapshot writes read it as a plain config tree and printed the
+  values Terraform itself refuses to print. `--mask-secrets` was not a backstop —
+  it fires on the attribute *name*, and `user_data` does not match. Realistic
+  ways to hit it: `flecto ci "**/*.json"`, a committed `tfplan.json`, or
+  `.flectorc` `files` patterns that sweep JSON. Those commands now fail with a
+  pointer to `flecto plan`, mirroring the guard `flecto plan` already had in the
+  other direction. ([#113])
+
 ### Added
 
 - **Inline suppressions in JSON** ([#158]). `.json` and `.jsonc` are parsed as
@@ -915,33 +980,6 @@ for what was wrong.
   60,000 characters to fit GitHub's comment limit, which lands under one pipe
   buffer.
 
-### Security
-
-- **Two denial-of-service vectors fixed, found while resuming the 3.0 security
-  review** ([#121]). (1) Secret detection (`src/secrets.js`), which runs on every
-  changed string value under the `default` pack, had two `O(n²)` regexes — the
-  PEM private-key and URL-credential patterns — so a single ~500 KB value in a
-  pull request could hang the CI job. Both are now linear; 1 MB scans in under a
-  second, and detection of real (including unterminated) keys is unchanged. (2) A
-  YAML alias bomb ("billion laughs") — a few hundred bytes of nested aliases that
-  `normalizeParsedValue` expanded into an exponentially large tree — now fails
-  fast against a node budget instead of exhausting memory. Regression tests for
-  both in `test/security.test.js`. The review's findings and its "checked, solid"
-  list are recorded in [docs/security-review.md](docs/security-review.md); a
-  residual limitation (attacker-supplied regexes in custom packs, which Node
-  cannot time out) is noted in [SECURITY.md](SECURITY.md).
-
-- **Terraform plan JSON is refused by every command except `flecto plan`.**
-  Terraform's `before_sensitive` / `after_sensitive` redaction is applied only by
-  `flecto plan`; a plan file is ordinary JSON, so `ci`, `watch`, `compare`,
-  `report`, and snapshot writes read it as a plain config tree and printed the
-  values Terraform itself refuses to print. `--mask-secrets` was not a backstop —
-  it fires on the attribute *name*, and `user_data` does not match. Realistic
-  ways to hit it: `flecto ci "**/*.json"`, a committed `tfplan.json`, or
-  `.flectorc` `files` patterns that sweep JSON. Those commands now fail with a
-  pointer to `flecto plan`, mirroring the guard `flecto plan` already had in the
-  other direction. ([#113])
-
 ## [3.0.1] - 2026-08-07
 
 ### Security
@@ -1438,7 +1476,9 @@ fixed — those runs were never actually gated — but the failure is new.
 - Misconfigured policy packs/plugins cause `watch` to exit non-zero instead of
   continuing with no policies.
 
-[Unreleased]: https://github.com/myselfsiddharth/Flecto/compare/v4.3.0...HEAD
+[Unreleased]: https://github.com/myselfsiddharth/Flecto/compare/v4.4.1...HEAD
+[4.4.1]: https://github.com/myselfsiddharth/Flecto/compare/v4.4.0...v4.4.1
+[4.4.0]: https://github.com/myselfsiddharth/Flecto/compare/v4.3.0...v4.4.0
 [4.3.0]: https://github.com/myselfsiddharth/Flecto/compare/v4.2.0...v4.3.0
 [4.2.0]: https://github.com/myselfsiddharth/Flecto/compare/v4.1.1...v4.2.0
 [4.1.1]: https://github.com/myselfsiddharth/Flecto/compare/v4.1.0...v4.1.1

package/README.md

@@ -77,7 +77,7 @@ aws_db_instance.main.#action
 
 Flecto PR Risk is on the
 [GitHub Marketplace](https://github.com/marketplace/actions/flecto-pr-risk), so
-`myselfsiddharth/Flecto@v4.2.0` is the whole reference.
+`myselfsiddharth/Flecto@v4.4.0` is the whole reference.
 
 **Terraform** — point it at the plan JSON:
 
@@ -91,7 +91,7 @@ steps:
   - run: |
       terraform plan -out=tf.plan
       terraform show -json tf.plan > plan.json
-  - uses: myselfsiddharth/Flecto@v4.2.0
+  - uses: myselfsiddharth/Flecto@v4.4.0
     with:
       terraform-plan: plan.json
       fail-on: error
@@ -109,7 +109,7 @@ steps:
     with:
       fetch-depth: 0
   - run: helm template ./chart > rendered.yaml
-  - uses: myselfsiddharth/Flecto@v4.2.0
+  - uses: myselfsiddharth/Flecto@v4.4.0
     with:
       targets: rendered.yaml
       policies: kubernetes

package/package.json

@@ -4,7 +4,7 @@
     "access": "public",
     "provenance": true
   },
-  "version": "4.3.0",
+  "version": "4.4.1",
   "description": "Reads your Terraform plan and Kubernetes changes and posts a plain-English risk summary on every pull request, blocking the dangerous ones",
   "license": "MIT",
   "keywords": [

package/src/differ.js

@@ -364,24 +364,43 @@ function identityMap(items, idKey) {
 // `KEY=VALUE`, or a bare `KEY` (Compose's pass-through from the host).
 export const ASSIGNMENT_RE = /^([A-Za-z_][A-Za-z0-9_.-]*)(?:=|$)/;
 
+// `-x`, `--name`, or `--name=value`: a command-line flag, keyed by its name.
+export const FLAG_RE = /^(-{1,2}[A-Za-z0-9][A-Za-z0-9_.-]*)(?:=|$)/;
+
 /**
- * Key a list of `KEY=VALUE` strings by KEY, or return null when it is not one.
+ * String-list shapes that are really maps, and how each is keyed.
  *
  * Compose writes `environment`, `labels` and `build.args` either as a map or as
- * a list of assignments, and means the same thing by both. Diffed by position,
+ * a list of `KEY=VALUE`, and means the same thing by both. Diffed by position,
  * one inserted variable turned every later line into a `changed` pairing two
- * unrelated variables (#226). At least one item must carry an `=`, so a plain
- * word list such as `command: [python, app.py]` keeps its order-sensitive diff.
+ * unrelated variables (#226); one removed container arg did the same to every
+ * later flag (#238). A list counts only when every item has the shape and keys
+ * are unique, so a repeated `--set` falls back to position.
+ *
+ * Assignments also need at least one `=`, so a plain word list such as
+ * `command: [python, app.py]` keeps its order-sensitive diff. A flag list does
+ * not: `[-v, --debug]` is already unambiguous, and `["--port", "8080"]` or
+ * `["-c", "echo hi"]` fail the shape and keep position.
+ * @type {Array<{ re: RegExp, needsValue: boolean }>}
+ */
+const KEYED_STRING_SHAPES = [
+  { re: ASSIGNMENT_RE, needsValue: true },
+  { re: FLAG_RE, needsValue: false },
+];
+
+/**
+ * Key a list of strings by the given shape, or return null when it is not one.
  * @param {unknown[]} items
+ * @param {RegExp} re
  * @returns {Map<string, { value: unknown, index: number }> | null}
  */
-function assignmentMap(items) {
+function keyedStringMap(items, re) {
   /** @type {Map<string, { value: unknown, index: number }>} */
   const map = new Map();
   for (let i = 0; i < items.length; i++) {
     const item = items[i];
     if (typeof item !== 'string') return null;
-    const match = ASSIGNMENT_RE.exec(item);
+    const match = re.exec(item);
     if (!match || map.has(match[1])) return null;
     map.set(match[1], { value: item, index: i });
   }
@@ -389,18 +408,22 @@ function assignmentMap(items) {
 }
 
 /**
- * Both sides are assignment lists and at least one item assigns a value.
+ * Both sides have the same keyed shape (see KEYED_STRING_SHAPES).
  * @param {unknown[]} before
  * @param {unknown[]} after
  * @returns {{ beforeMap: Map<string, { value: unknown, index: number }>, afterMap: Map<string, { value: unknown, index: number }> } | null}
  */
 function assignmentMaps(before, after) {
-  const beforeMap = assignmentMap(before);
-  const afterMap = beforeMap && assignmentMap(after);
-  if (!beforeMap || !afterMap) return null;
   const assigns = (item) => typeof item === 'string' && item.includes('=');
-  if (!before.some(assigns) && !after.some(assigns)) return null;
-  return { beforeMap, afterMap };
+  for (const { re, needsValue } of KEYED_STRING_SHAPES) {
+    const beforeMap = keyedStringMap(before, re);
+    const afterMap = beforeMap && keyedStringMap(after, re);
+    if (!beforeMap || !afterMap) continue;
+    if (beforeMap.size === 0 && afterMap.size === 0) continue;
+    if (needsValue && !before.some(assigns) && !after.some(assigns)) continue;
+    return { beforeMap, afterMap };
+  }
+  return null;
 }
 
 /**

package/src/positions.js

@@ -3,7 +3,7 @@ import yaml from 'js-yaml';
 
 import { isArmoredAgeFile } from './encrypted.js';
 import { isEnvFilename, isIniFilename, stripJsonComments, yamlDocumentKeys } from './parser.js';
-import { ASSIGNMENT_RE } from './differ.js';
+import { ASSIGNMENT_RE, FLAG_RE } from './differ.js';
 
 /**
  * Where a config path lives in the source text (#142).
@@ -248,10 +248,13 @@ function itemByIdentity(items, quoted, arrayIdKey) {
       if (String(id) === target) matches.add(item);
     }
   }
-  // A `KEY=VALUE` list (Compose `environment`, `labels`) is keyed by KEY.
+  // A `KEY=VALUE` list (Compose `environment`, `labels`) is keyed by KEY, and
+  // a flag list (container `args`) by flag name.
   if (matches.size === 0 && !arrayIdKey) {
     for (const item of items) {
-      if (typeof item.value === 'string' && ASSIGNMENT_RE.exec(item.value)?.[1] === target) matches.add(item);
+      if (typeof item.value !== 'string') continue;
+      const key = ASSIGNMENT_RE.exec(item.value)?.[1] ?? FLAG_RE.exec(item.value)?.[1];
+      if (key === target) matches.add(item);
     }
   }
   return matches.size === 1 ? [...matches][0] : null;

package/src/secrets.js

@@ -116,10 +116,14 @@ const PLACEHOLDER_RE = /^(?:\$\{[^}]*\}|\$\([A-Za-z_][A-Za-z0-9_]*\)|\{\{[^}]*\}
  * subresource-integrity strings (sha512-…), and base64 of ordinary ASCII text.
  *
  * Measured on a corpus of 3,000 random base64url/base62 tokens (lengths 24–64)
- * and a hand-built corpus of benign config values: 0 false positives, ~5% of
- * random tokens missed (worst at length 24, ~7%). Standard-base64 secrets that
- * contain "/" are always missed by this fallback by construction — the known
- * formats above are what covers those.
+ * and a hand-built corpus of benign config values: 0 false positives on that
+ * corpus; ~5% of random tokens missed (worst at length 24, ~7%). Other
+ * corpora can still yield false positives when a value is an opaque public
+ * identifier structurally indistinguishable from secret material — e.g. Google
+ * Place IDs (ChIJN1t_tDeuEmsRUsoyG83frY4) and IPFS CIDv0 hashes
+ * (QmYwAPJzv5CZsnA625s3Xf2nemtYgPpHdWEz79ojWnPbdG). Standard-base64 secrets
+ * that contain "/" are always missed by this fallback by construction — the
+ * known formats above are what covers those.
  */
 const ENTROPY_MIN_LENGTH = 24;
 const ENTROPY_MIN_BITS = 4.0;
@@ -347,9 +351,152 @@ export function redactSecretString(value) {
  */
 export const SECRET_PATH_RE = /(secret|token|password|api[_-]?key|private[_-]?key|credential)/i;
 
+// Whole words that name a credential, after splitting a key on camelCase and
+// punctuation. A word that *ends* in one also counts, for keys written with no
+// separator (`DBPASSWORD`, `accesstoken`), but one that only *starts* with one
+// does not: `tokenizer` is not a token, `passwordless` is not a password.
+const SECRET_WORDS = ['secrets', 'secret', 'tokens', 'token', 'passwords', 'password', 'passwd', 'credentials', 'credential', 'apikey', 'privatekey'];
+const SECRET_PAIRS = [['api', 'key'], ['private', 'key']];
+/**
+ * A last word that makes a secret-named key *about* the secret rather than the
+ * secret: `secretName`, `passwordPolicy`, `tokenTTL`, `secretUser`. Not `key`
+ * (`apiKey`, `secretKey` are credentials) and not `id` (Vault's `secret_id`).
+ */
+const METADATA_WORDS = new Set([
+  'name', 'names', 'ref', 'refs', 'user', 'username', 'policy', 'policies', 'ttl', 'expiry', 'expiration',
+  'lifetime', 'timeout', 'length', 'path', 'file', 'url', 'uri', 'endpoint', 'header', 'type', 'enabled',
+  'mode', 'format', 'rotation', 'version', 'count', 'size', 'prefix', 'suffix', 'store', 'provider',
+  'manager', 'namespace', 'selector', 'annotations', 'labels', 'mount', 'volume', 'dir', 'location',
+  'interval', 'issuer', 'threshold', 'duration', 'seconds', 'retry', 'config', 'configuration', 'settings',
+  'options', 'job', 'jobs', 'generator', 'source', 'review', 'init', 'controller', 'operator', 'webhook',
+  'sync', 'cache',
+]);
+/**
+ * Keys that are structure, not content, when their parent names a secret:
+ * `password: { secret: db, key: password }` (a reference), `clientSecret: {
+ * type: string }` (a schema), a projected `serviceAccountToken: { audience,
+ * expirationSeconds, path }`.
+ */
+const STRUCTURAL_KEYS = new Set([
+  'name', 'key', 'namespace', 'type', 'description', 'format', 'enabled', 'enable', 'optional', 'required',
+  'mode', 'defaultmode', 'items', 'path', 'mountpath', 'subpath', 'readonly', 'audience', 'aud',
+  'expirationseconds', 'issuer', 'provider', 'kind', 'apiversion', 'version', 'labels', 'annotations',
+  'selector', 'prefix', 'suffix', 'header', 'ttl', 'rotationpolicy', 'algorithm', 'encoding', 'size',
+  'length', 'image', 'repository', 'registry', 'tag', 'pullpolicy', 'digest', 'create', 'secretname',
+  // JSON-schema keywords: a CRD's `clientSecret: { type: string, maxLength: 64 }`.
+  'properties', 'additionalproperties', 'maxproperties', 'minproperties', 'maxlength', 'minlength',
+  'pattern', 'enum', 'default', 'minimum', 'maximum', 'nullable', 'xkubernetesmaptype',
+  'xkuberneteslisttype', 'xkubernetespreserveunknownfields', 'xkubernetesvalidations',
+]);
+
+// Last words of keys that group structure: `containerSecurityContext`,
+// `matchLabels`, `matchExpressions`, `podSpec`.
+const STRUCTURE_WORDS = new Set(['context', 'labels', 'expressions', 'spec', 'metadata', 'status', 'template', 'resources', 'probe', 'affinity', 'tolerations', 'ports', 'service', 'ingress', 'rules', 'schema']);
+
+// Containers that carry a secret's contents under arbitrary keys.
+const TRANSPARENT_KEYS = new Set(['data', 'stringdata', 'values', 'value', 'env', 'environment', 'vars', 'variables', 'entries', 'keys']);
+
+/**
+ * The named keys of a diff path, indices dropped: `a.b[0]["C"]` -> a, b, C.
+ * @param {string} path
+ * @returns {string[]}
+ */
+function pathKeys(path) {
+  /** @type {string[]} */
+  const keys = [];
+  for (const match of path.matchAll(/\["((?:[^"\\]|\\.)*)"\]|\[[^\]]*\]|([^.[\]]+)/g)) {
+    if (match[1] !== undefined) {
+      try {
+        keys.push(JSON.parse(`"${match[1]}"`));
+      } catch {
+        keys.push(match[1]);
+      }
+    } else if (match[2] !== undefined) {
+      keys.push(match[2]);
+    }
+  }
+  return keys;
+}
+
+/**
+ * Lowercased words of a key: `adminPasswordKey` -> admin, password, key.
+ * @param {string} key
+ * @returns {string[]}
+ */
+function keyWords(key) {
+  return key
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter(Boolean);
+}
+
+/**
+ * Index of the word that names a credential, or -1.
+ * @param {string[]} words
+ * @returns {number}
+ */
+function secretWordIndex(words) {
+  for (let i = 0; i < words.length; i++) {
+    if (SECRET_WORDS.some((word) => words[i] === word || words[i].endsWith(word))) return i;
+    if (SECRET_PAIRS.some(([a, b]) => words[i] === a && words[i + 1] === b)) return i + 1;
+  }
+  return -1;
+}
+
+/**
+ * Lowercase alphanumerics only: `x-kubernetes-map-type` -> `xkubernetesmaptype`.
+ * @param {string} key
+ * @returns {string}
+ */
+function normalizeKey(key) {
+  return key.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+
+/**
+ * A key that groups structure rather than content, so a credential name above
+ * it does not reach below it: `selector`, `matchLabels`, `securityContext`,
+ * `authorizationHeader`, `tokenReviewConfig`.
+ * @param {string} key
+ * @returns {boolean}
+ */
+function isStructureOrMetadata(key) {
+  if (STRUCTURAL_KEYS.has(normalizeKey(key))) return true;
+  const last = keyWords(key).at(-1);
+  return last !== undefined && (METADATA_WORDS.has(last) || STRUCTURE_WORDS.has(last));
+}
+
+/**
+ * A key that names a credential: a secret word whose key does not end in a
+ * metadata word. `password`, `apiKey`, `DB_PASSWORD` yes; `secretName`,
+ * `createSecretJob`, `tokenRefreshInterval` no.
+ * @param {string} key
+ * @returns {boolean}
+ */
+function namesCredential(key) {
+  const words = keyWords(key);
+  const at = secretWordIndex(words);
+  return at >= 0 && !(at < words.length - 1 && METADATA_WORDS.has(words.at(-1)));
+}
+
 /**
  * True when a configuration path names a credential.
  *
+ * Decided on the leaf's own key and its parent, not on any key anywhere above
+ * it. Matching the whole path (as SECRET_PATH_RE did) masked and flagged
+ * `capabilities.drop[0]` under `redisSecretInit`, `matchLabels.app` under
+ * `apiKey`, `tokenizer.flavor`, and the `type`/`description` of every CRD
+ * schema property called `clientSecret` (#248). So:
+ *
+ * - own key names a credential (whole word, or ending in one), unless its last
+ *   word is metadata (`secretName`, `passwordPolicy`, `tokenTTL`)
+ * - or the parent does (`sharedSecret.value`, `secrets.db`), unless the leaf is
+ *   structural (`name`, `key`, `type`, `audience`, ...)
+ *
+ * A credential stored deeper, or under an innocuous name, is the value
+ * detector's job; it runs on every value regardless.
+ *
  * Lives here rather than beside either caller because there are two of them —
  * the renderer masking a diff for display, and the snapshot store masking a
  * state for a commit — and a store that recognized fewer key names than the
@@ -359,7 +506,29 @@ export const SECRET_PATH_RE = /(secret|token|password|api[_-]?key|private[_-]?ke
  * @returns {boolean}
  */
 export function looksLikeSecretPath(path) {
-  return SECRET_PATH_RE.test(path);
+  const keys = pathKeys(path);
+  const own = keys.at(-1);
+  if (own === undefined) return false;
+  if (secretWordIndex(keyWords(own)) >= 0) return namesCredential(own);
+  // Walk up to the nearest key that names a credential. A Secret's `data` /
+  // `stringData` (and the like) are looked through, and make the leaf a secret
+  // whatever it is called: `encryptedSecret.stringData.key1`. Otherwise the leaf
+  // must not be structural (`password.key` is a reference), and the walk stops
+  // at a key that is structure or metadata (`apiKey.selector.matchLabels.app`,
+  // `credentials.authorizationHeader.prefix`), which is where matching any
+  // ancestor went wrong. `secrets.prod.db` still counts.
+  const leafIsStructural = STRUCTURAL_KEYS.has(normalizeKey(own));
+  let throughData = false;
+  for (let i = keys.length - 2; i >= 0; i--) {
+    const key = keys[i];
+    if (TRANSPARENT_KEYS.has(key.toLowerCase())) {
+      throughData = true;
+      continue;
+    }
+    if (namesCredential(key)) return throughData || !leafIsStructural;
+    if (isStructureOrMetadata(key)) return false;
+  }
+  return false;
 }
 
 /**
@@ -426,10 +595,13 @@ function lastPathSegment(path) {
  * @returns {boolean}
  */
 export function isSecretCandidate(value, path = '') {
+  if (!looksLikeSecretPath(path)) return false;
   if (value === null || value === undefined || typeof value === 'boolean') return false;
   if (typeof value !== 'string') return true;
   const trimmed = value.trim();
   if (!trimmed || KEY_PLACEHOLDER_RE.test(trimmed)) return false;
+  // YAML 1.1 booleans that arrive as strings (`server-tokens: "false"`).
+  if (/^(?:true|false|yes|no|on|off)$/i.test(trimmed)) return false;
   const assignment = ASSIGNMENT_RE.exec(trimmed);
   if (assignment && KEY_PLACEHOLDER_RE.test(assignment[1].trim())) return false;
   const isReference = REFERENCE_KEY_RE.test(lastPathSegment(path)) || SECRET_KEY_REF_RE.test(path);