81f2d2b200125843fa0ebfe94489e5355771043f

Message

Make less sensitive to secrets

Diff

This diff is truncated to protect this page.

 1diff --git a/src/rules.ts b/src/rules.ts
 2index 5b2fe8bbba0df2c3aac86dce77c1a7fba5c4ae54..47388538e14467e2903623f64579f37d0ca46f22 100644
 3--- a/src/rules.ts
 4+++ b/src/rules.ts
 5@@ -1,5 +1,5 @@
 6 // Bump to invalidate all cached decisions when rules change.
 7-export const POLICY_VERSION = 16;
 8+export const POLICY_VERSION = 17;
 9 
10 // Trailing stderr redirections that are safe to strip before pattern matching.
11 // `2>&1` and `2>/dev/null` have no security implication but would otherwise
12@@ -160,7 +160,7 @@ Bash input is one command node, not a whole script. Evaluate that command alone.
13 Ask:
14 - Privilege escalation (sudo, su, doas)
15 - Wide destructive commands (e.g. rm -rf /, /etc, /usr, ~/).
16-- Reading or exposing obvious secret material (~/.ssh, ~/.aws, ~/.config, .env, credentials, *.pem, *.key), don't assume anything could be secret.