Files
felhom.eu/documentation/audits/SPIKE-cc-creds-2026-10-17/probes/settings-Q2.json
T
adminandClaude Opus 5.5 b9c4f73bfa
gates / gates (push) Failing after 6m36s
SPIKE cc-creds: secret broker + CC transcript guards measured with canaries (R-1118..R-1122, 168 -> 173)
Mask PASS, PreToolUse refuse PASS, PostToolUse replace PARTIAL (crash and
large-output disk leaks, both with a measured fix), SOPS+age store PARTIAL
(private repo could not be created), transcript sweep PASS. Fake secrets
only; ~/.config/credentials not read; no CC settings changed. Files use
"creds": .gitignore *secret* ignores the brief's names. STATUS D10: the
store choice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
2026-10-17 11:57:24 +02:00

29 lines
536 B
JSON

{
"permissions": {
"allow": [
"Bash(source:*)",
"Bash(printenv)",
"Bash(printenv:*)",
"Bash(curl:*)",
"Bash(kubectl get:*)",
"Bash(ls:*)",
"Bash(cat:*)",
"Bash(true)"
]
},
"hooks": {
"PreToolUse": [
{
"matcher": "Bash",
"hooks": [
{
"type": "command",
"command": "python3 /home/kisfenyo/spike-cc-secrets/pre.py",
"timeout": 10,
"onFailure": "block"
}
]
}
]
}
}