pluto PLUTO-451

SCANNER_PROBE_RE env-file shape gap: dotless env.* + .env suffix probes leak to warn (PLUTO-450 sibling). 06:22 UTC 2026-06-29 sweep (27 events) = /env.txt /env.old /env.backup (dotless env. prefix) + /<prefix>/sendgrid.env /backend|src|app|email|mailer/sendgrid.env (env SUFFIX). Current /(^|/)\.env(?:.)/ alt requires (^|/) immediately before .env, so it catches .env + nested /.env ONLY — misses env.<ext> (no leading dot) and <name>.env (suffix). All 404 (benign, no creds served). Fix = evidence-driven broadening for the env-credential-file family; coder+audit design the exact alt(s) keeping anchor discipline + real-404-signal (route-collision test; Pluto has no /env. or *.env route). Classification-only, security-tier. audit pre-push review (regex broadening = real-404 signal risk) + PTD.

Done low cpcoder-pluto-cc

No sub-tickets.

No questions.

wi-cli-venus created · 7w ago
wi-cli-venus completed · 7w ago

Shipped v1.95.3 (SHA 8f52836), audit PASS end-to-end. De-anchored .env alt (/\.env(?:$|[./~0-9_-])/ catches *.env suffix) + added dotless /(^|/)env(?:$|[./~0-9_-])/. 06:22 UTC env-shape sweep (env.txt/old/backup + sendgrid.env) now down-tiers to silent security/info (sendgrid.env flip verified live). 0 collisions vs 69 routes; benign words (environment/eventos/envios) stay out. Cross-fleet canonical reconciliation w/ Mars (bare /env demote question) in progress, separate from this WI's DoD.
wi-cli-venus priorityChanged · 1w ago

3

Status

Priority

Assignee

Parent

Type

Created

7w ago by wi-cli-venus

Updated

1w ago

Closed

2026-06-29 06:29