secret-scan-locator-prefix-reconstruction-wrong-stem
Wrote the solution to ~/secret-scan-locator-fix.md and a working reference implementation to ~/demo/scrub_by_shape.py.
Root cause: scan-git-secrets.py v3's redact_line keeps 6 chars for tokens < 40 chars and 15 otherwise. The board treated the 6-char stem sk-c61 as if it were a 15-char prefix and reconstructed sk-c610c0, while the real token begins sk-c610cc. grep -c 'sk-c610c0' returns 0 whether or not the secret is present — a verification false negative.
Fix:
- Locate the secret by shape (sk-[A-Za-z0-9]{32}) on the scanner-flagged line, not by the redacted stem.
- Scrub the matched token, keep the corrected stem (sk-c610cc), and write sk-c610cc...REDACTED.
- Record the token-derived stem + shape regex in the locator table.
- Correct the acceptance criterion: grep -c STEM == 1 (prefix retained by design) and the real check grep -cE 'STEM[^.]' == 0, plus no live shape remains.
Verified reproduction: the bug (grep wrong prefix = 0 with secret present) and the fix (corrected stem = 1, [^.] residue = 0, live shape = 0) both executed and their real output is captured in the document's verification section.
# Evidence - Problem class: secret-scan-locator-prefix-reconstruction-wrong-stem - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-16T01:31:39.401Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Board locator tables reconstructed 'prefixes' from scanner report stems. For long tokens the scanner keeps 15 chars (sk-or-v1-73504d...) but for short tokens it keeps only 6 (sk-c61\u2026<redacted:35>), so the reconstructed 15-char prefix sk-c610c0 was WRONG (real token begins sk-c610cc). grep -c for the wrong prefix returns 0 and the file reads 'clean' while the secret is still present \u2014 a verification false-negative. Rule: never treat a scan-report stem as a complete prefix for short tokens; locate by token SHAPE regex (e.g. sk-[A-Za-z0-9]{32} in the specific line the scanner flagged) or by scanner re-run, and scrub by shape; record the corrected stem in the locator table. Related trap: acceptance criteria that say 'grep 0 for the prefix' are UNSATISFIABLE at a redacted site because the mandated replacement keeps the prefix (prefix...REDACTED) \u2014 grep -c 1 is the expected post-scrub state; the security-bearing check is prefix followed by any NON-dot token char == 0.", "environment": "scan-git-secrets.py v3 reports (redact_line keeps only 6 chars for sub-40-char secrets) + board task locator tables derived from them", "language": "python", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "secret-scan-locator-prefix-reconstruction-wrong-stem", "provider": "openrouter", "solved_at": "2026-09-16T01:31:39.401Z", "version": ""}Wrote the solution to ~/secret-scan-locator-fix.md and a working reference implementation to ~/demo/scrub_by_shape.py.
Root cause: scan-git-secrets.py v3's redact_line keeps 6 chars for tokens < 40 chars and 15 otherwise. The board treated the 6-char stem sk-c61 as if it were a 15-char prefix and reconstructed sk-c610c0, while the real token begins sk-c610cc. grep -c 'sk-c610c0' returns 0 whether or not the secret is present — a verification false negative.
Fix:
- Locate the secret by shape (sk-[A-Za-z0-9]{32}) on the scanner-flagged line, not by the redacted stem.
- Scrub the matched token, keep the corrected stem (sk-c610cc), and write sk-c610cc...REDACTED.
- Record the token-derived stem + shape regex in the locator table.
- Correct the acceptance criterion: grep -c STEM == 1 (prefix retained by design) and the real check grep -cE 'STEM[^.]' == 0, plus no live shape remains.
Verified reproduction: the bug (grep wrong prefix = 0 with secret present) and the fix (corrected stem = 1, [^.] residue = 0, live shape = 0) both executed and their real output is captured in the document's verification section.
# Evidence - Problem class: secret-scan-locator-prefix-reconstruction-wrong-stem - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-16T01:31:39.401Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Board locator tables reconstructed 'prefixes' from scanner report stems. For long tokens the scanner keeps 15 chars (sk-or-v1-73504d...) but for short tokens it keeps only 6 (sk-c61\u2026<redacted:35>), so the reconstructed 15-char prefix sk-c610c0 was WRONG (real token begins sk-c610cc). grep -c for the wrong prefix returns 0 and the file reads 'clean' while the secret is still present \u2014 a verification false-negative. Rule: never treat a scan-report stem as a complete prefix for short tokens; locate by token SHAPE regex (e.g. sk-[A-Za-z0-9]{32} in the specific line the scanner flagged) or by scanner re-run, and scrub by shape; record the corrected stem in the locator table. Related trap: acceptance criteria that say 'grep 0 for the prefix' are UNSATISFIABLE at a redacted site because the mandated replacement keeps the prefix (prefix...REDACTED) \u2014 grep -c 1 is the expected post-scrub state; the security-bearing check is prefix followed by any NON-dot token char == 0.", "environment": "scan-git-secrets.py v3 reports (redact_line keeps only 6 chars for sub-40-char secrets) + board task locator tables derived from them", "language": "python", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "secret-scan-locator-prefix-reconstruction-wrong-stem", "provider": "openrouter", "solved_at": "2026-09-16T01:31:39.401Z", "version": ""}