Fix: Increase Entropy Requirement for Secret Redaction to Reduce False Positives #6875
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
End-user friendly description of the problem this fixes or functionality that this introduces
If a value has less than 8 characters, it will not be considered a secret as it does not have enough entropy
Give a summary of what the PR does, explaining any non-trivial design decisions
The new logging filters can sometimes lead to unusual outcomes - we look at the environment for any variable with a name containing the terms
KEY
,CODE
,SECRET
orTOKEN
and replace those values with ****** in the logs - it seems in my env myAWS_ACCESS_KEY_ID
was set todefault
, so any time the worddefault
appeared in the logs it was redacted! By increasing the entropy requirement we remove false positives.Link of any specific issues this addresses
To run this PR locally, use the following command: