Repository navigation
fix: hide the Splunk Cloud stack name at untrusted output boundaries - #83
Open
JacobPEvans-personal wants to merge 8 commits into
Open
JacobPEvans-personal wants to merge 8 commits into
JacobPEvans-personal wants to merge 8 commits into
Conversation
Opt-in via VCT_SPLUNK_REDACT_TARGET=1: hides the Cloud stack label in prompts, JSON metadata, and transport error text, without touching the audit log (which still records the real host). `splunk inspect` reports `stack_configured: bool` instead of echoing the stack name. The Splunk Cloud Read Canary workflow sets the variable and scans its own pytest output for a leaked target or credential before publishing anything.
This was referenced Aug 18, 2026
Draft
Delete .github/scripts/scan-cloud-ci-leaks.py and its invocation from run-cloud-suite.sh, and drop the corresponding mentions in cloud-read.yml and CHANGELOG.md.
Assisted-by: Claude:claude-opus-5-5 Claude-Session: https://claude.ai/code/session_01MkCDG3PVVwxfoLyGSpg9is
Assisted-by: Claude:claude-opus-5-5 Claude-Session: https://claude.ai/code/session_01MkCDG3PVVwxfoLyGSpg9is
Assisted-by: Claude:claude-opus-5-5 Claude-Session: https://claude.ai/code/session_01MkCDG3PVVwxfoLyGSpg9is
Assisted-by: Claude:claude-opus-5-5 Claude-Session: https://claude.ai/code/session_01MkCDG3PVVwxfoLyGSpg9is
Assisted-by: Claude:claude-opus-5-5 Claude-Session: https://claude.ai/code/session_01MkCDG3PVVwxfoLyGSpg9is
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First of a 3-PR stack replacing #80. Redaction only, no write code.
VCT_SPLUNK_REDACT_TARGETset to a truthy value, the output formatter hides Splunk Cloud stack names in everything it renders: JSON/table data and metadata, error-envelope messages and details, and write confirmation prompts. Commercial and FedRAMP ACS paths are covered. The audit log is unaffected and always records the real host.splunk inspectreportsstack_configured: boolinstead of echoing the Cloud stack name.Splunk Cloud Read Canaryworkflow calls pytest directly and sets the redaction variable.utils.validation.env_flag, shared by every boolean environment variable that is not a write gate.Test plan
ruff check .,ruff format --check .,pyright,pytest(1059 passed)tests/unit/test_redact_public_text.py: opt-in, truthy values, ports, Enterprise targets untouched, credential stripping, ACS path variants, idempotencyauth statusdata and metadata, and the error envelope, covered intest_auth.pyandtest_output.py🤖 Generated with Claude Code
https://claude.ai/code/session_01MkCDG3PVVwxfoLyGSpg9is