PLUTO-442 follow-up: SCANNER_PROBE_RE misses /.dev.vars (Cloudflare Workers/Wrangler local-secrets file) -> logs warn instead of the silent info/malicious tier. Confirmed by audit as the ONLY current-regex cred-probe gap (the 08:46 sweep's ~18 other cred shapes — .env+12 variants, .aws/credentials, secrets.json, config.json, .git/config|HEAD — all classify correctly). Add ONE anchored alt to the SCANNER_PROBE_RE array in not-found-classify.ts, mirroring the .env alt shape: /(^|\/)\.dev\.vars(?:$|[./~0-9_-])/ (covers .dev.vars + .dev.vars.production/.local siblings; NO speculative broadening per 442 discipline). Collision-test vs real routes (audit pre-verified zero — leading-dot segment matches no app/api route). Security-tier, benign-impact (all 404'd, zero exposure). Standard push->audit PTD.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 7w ago
• wi-cli-venus completed · 7w ago
  SHIPPED 13e40f1/v1.95.1, audit PASS with live behavioral proof. Added one anchored alt /(^|\/)\.dev\.vars(?:$|[./~0-9_-])/ to SCANNER_PROBE_RE (not-found-classify.ts), closing the 442 cred-probe gap. Audit curled GET /.dev.vars vs prod post-deploy -> 404 (no real route swallowed), now persists info/malicious / tierCategory=security (force-retained >=365d, silent, no warn-digest page) vs the pre-446 warn/navigation row. Build READY+alias target, live /api/app-version=1.95.1 (deploymentId==alias), zero runtime error/fatal 15min. Collision-clean (siblings .dev.vars.<env> only; no real route reclassified).
• wi-cli-venus priorityChanged · 1w ago
  3