Eight community-filed bugs fixed in one wave, four of them security guards that were quietly failing open.
- Redaction gate now catches modern OpenAI keys with sk-proj-, sk-svcacct-, and sk-admin- prefixes
- Redaction size cap no longer fails open on a bad flag
- Cross-project learnings trust gate no longer leaks untrusted rows between projects
- Destructive-action classifier now correctly flags password rotation patterns
- /ship adversarial review no longer chokes on security tests
From gstack
Your redaction gate now catches modern OpenAI keys, and /ship's adversarial review stops choking on your own security tests. This is a fix wave. The throughline: guards that reported success while doing nothing. The secret-redaction gate that every /spec, /ship, /cso, and /document-* run passes through was blind to modern sk-proj-/sk-svcacct-/sk-admin- OpenAI keys and silently dropped its size cap on a bad flag. The cross-project learnings trust gate was an allowlist on paper and a denylist in code, so untrusted rows leaked between projects. The destructive-action classifier waved through "rotate the database password." Each one looked like it was protecting you. None of them were. All four now fail closed, with tests that pin the exact case that used to slip by.
Fixed: Redaction misses modern OpenAI keys. Redaction size cap fails open on a bad flag. Cross-project learnings trust gate leaked. Destructive-action classifier missed rotate password pattern.