Never save "****" as a secret #206

Merged

jcoffey-dev merged 1 commits from fix/keep-masked-secrets into main

2026-10-18 22:21:30 +00:00

Author	SHA1	Message	Date
jcoffey-dev	8bd5b3f697	Never save "**" as a secret ci / fork-checks (pull_request) Skipped Details ci / build (pull_request) Skipped Details github/ci (branch) GitHub Actions Details ci / github (pull_request) Successful in 24m7s Details A stored secret reads back as "", and a registry write that sent it back stored "**" as the secret: a webhook's password or signing key, a store's or directory's password, a DNS provider's key, an OAuth client's secret. Written straight at a secret it now keeps the stored one; anywhere else, inside a whole object, a create or a variant switch, the write is refused with invalidProperties, since there's no stored secret it could stand for. Accounts keep their own credential checks, which already did this.	2026-10-18 14:49:52 -07:00

Author

SHA1

Message

Date

jcoffey-dev

8bd5b3f697

Never save "****" as a secret

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 24m7s

Details

A stored secret reads back as "****", and a registry write that sent it
back stored "****" as the secret: a webhook's password or signing key,
a store's or directory's password, a DNS provider's key, an OAuth
client's secret. Written straight at a secret it now keeps the stored
one; anywhere else, inside a whole object, a create or a variant switch,
the write is refused with invalidProperties, since there's no stored
secret it could stand for. Accounts keep their own credential checks,
which already did this.

2026-10-18 14:49:52 -07:00