marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(hardening): Phase 15 — redaction, retry/backoff, budgets, threat-model docs

Browse Source 
Release-readiness hardening.

- redaction.py (zero-dep): redact_secrets masks provider API keys, AWS/GitHub/Slack/
  Google tokens, bearer tokens, URL-embedded credentials, PEM private keys, and
  sensitive key=value assignments. Wired into the trace writer and the markdown report
  (on by default), so scan artifacts never leak a credential quoted from source.
- provider/openrouter.py: call_with_retry — exponential backoff on transient failures
  (HTTP 429/5xx, connection errors, timeouts); non-transient errors fail fast. Both the
  chat and embedding clients use it (max_attempts/retry_base_delay configurable).
- config [hardening]: redact_secrets (default true) + max_findings (bounded-CI output
  cap, 0 = unlimited; truncation is severity-ordered and disclosed as a `budget`
  degradation). Agentic spend stays bounded by [harnessx] max_cost_usd/token_threshold.
- docs/threat-model.md (trust boundaries, controls, sandbox limits) + docs/examples.md
  (six end-to-end walkthroughs); README "Security & hardening" section links both.
- CI lint/typecheck/test/detection-gate/dagger gates already existed.

tests/test_redaction.py, test_provider_retry.py, test_hardening_pipeline.py + config
tests. 206 passed, 4 skipped; ruff + mypy clean; detection gate PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-06-22 20:02:34 +02:00
co-authored by Claude Opus 4.8
parent 3fd0057e5f
commit b5e40318db
15 changed files with 505 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/openrouter-sast-harness/tasks.md
+13 -6
View File
@@ -288,9 +288,16 @@ skill context; tests in `tests/test_skills.py`.
## Phase 15: Hardening And Release Readiness (`production` prerequisite)
- [ ] Add cost budget enforcement.
- [ ] Add model call retry and backoff policies.
- [ ] Add redaction for secrets in traces and reports.
- [ ] Add docs for threat model and sandbox limits.
- [ ] Add end-to-end examples.
- [ ] Add lint, typecheck, test, and CI gates.
Implemented: `redaction.py` (traces/reports), provider retry/backoff in
`provider/openrouter.py`, `[hardening]` config (redact_secrets + max_findings budget;
agentic spend bounded by `[harnessx]`), `docs/threat-model.md`, `docs/examples.md`.
Tests in `tests/test_redaction.py`, `tests/test_provider_retry.py`,
`tests/test_hardening_pipeline.py`. CI gates pre-existed (ruff/mypy/pytest/detection
gate/dagger).
- [x] Add cost budget enforcement.
- [x] Add model call retry and backoff policies.
- [x] Add redaction for secrets in traces and reports.
- [x] Add docs for threat model and sandbox limits.
- [x] Add end-to-end examples.
- [x] Add lint, typecheck, test, and CI gates.