# ruflo v3.38.5 — v3.38.5 — .brain skip, --repo passthrough, secret regex

- Product: ruflo (https://whatsnew.fyi/product/ruflo)
- Vendor: ruflo
- Date: 2026-08-12
- Version: v3.38.5
- Original notes: https://github.com/ruvnet/ruflo/releases/tag/v3.38.5
- Permalink: https://whatsnew.fyi/product/ruflo/releases/v3.38.5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — ruflo-adr's ADR importer was indexing thousands of foreign ADRs from ruvnet-brain's cloned repos by omitting .brain from SKIP_DIRS; added .brain to SKIP_DIRS and fixed the plugin's smoke test which hard-coded its regression-test-file count
- **fixed** — github_issue_track's create/update/close/list actions now pass --repo <owner>/<repo> to gh when both owner and repo are supplied, ensuring operations target the specified repository instead of silently resolving from the current working directory's git remote
- **fixed** — security scan's hardcoded-secret detection now uses lookaround word-boundaries and a lower length floor to detect common real-world Stripe and OpenAI key shapes, including shorter keys and Authorization header Bearer token patterns

##### Fixes

**#2911 — `ruflo-adr`'s ADR importer indexed thousands of foreign ADRs from ruvnet-brain's cloned repos, burying the project's own.** `SKIP_DIRS` omitted `.brain`, which holds shallow clones of ~50 external repos, many with their own `docs/adr/`. Since `.brain` sorts before `docs`, the project's own ADRs landed dead last in the walk order — an interrupted run could index hundreds of foreign ADRs and zero of the project's own. Added `.brain` to `SKIP_DIRS`. Also fixed the plugin's own smoke test, which hard-coded its regression-test-file count and broke on the new test file this fix added.

**#2963 — `github_issue_track`'s `create`/`update`/`close`/`list` actions validated the caller-supplied `owner`/`repo` but never passed them to `gh`.** `gh` silently resolved the target repository from the current working directory's git remote instead — a caller supplying `owner`/`repo` expecting an operation to land in that specific repository had no guarantee it did. Now passes `--repo <owner>/<repo>` to `gh` whenever both are supplied.

**#2931 — `security scan`'s hardcoded-secret detection missed common real-world Stripe/OpenAI key shapes.** The regex required 20+ characters after the `sk-`/`sk_live_`/`sk_test_` prefix (missing shorter-but-real keys) and a quote literally adjacent to the prefix (missing the very common `Authorization: "Bearer sk_live_..."` shape, where the quote sits next to "Bearer", not the key). Replaced with lookaround word-boundaries and a lower length floor.

##### Links

- PR: [#2994](https://github.com/ruvnet/ruflo/pull/2994)
- PR: [#2995](https://github.com/ruvnet/ruflo/pull/2995)
- PR: [#2996](https://github.com/ruvnet/ruflo/pull/2996)
- Previous release: [v3.38.4](https://github.com/ruvnet/ruflo/releases/tag/v3.38.4)