pezkuwichain/pezkuwi-wallet-utils
1
Fork 0
mirror of https://github.com/pezkuwichain/pezkuwi-wallet-utils.git synced 2026-10-20 18:56:26 +00:00
Code Releases Activity

fix: exclude public account-id fields from the private-key heuristic

Browse Source 
The hardcoded-secret scan flags any 64-hex 0x value in JSON as a possible
private key. The restored balance-test fixtures store public 32-byte
account IDs under "account" fields - public data by definition, tripping
the scan as a false positive. Scope the exclusion to the exact field name
rather than loosening the pattern itself.
This commit is contained in:
Satoshi Qazi Muhammed committed 2026-07-19 00:11:53 -07:00
1 parent 6b82731bad
commit 2efadcca07
1 file changed
+2 -1
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/security.yml
+2 -1
View File
@@ -60,7 +60,8 @@ jobs:
FOUND=0 FOUND=0
echo "Checking for private keys in config files..." echo "Checking for private keys in config files..."
if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions"; then # "account" fields hold public 32-byte account IDs (balance-test fixtures), not private keys
if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions\|\"account\":"; then
echo "::error::Possible private key found" echo "::error::Possible private key found"
FOUND=1 FOUND=1
fi fi