fix: remediate security insights by adityathebe · Pull Request #325 · flanksource/commons

adityathebe · 2026-07-03T14:03:45Z

Faro reported high severity security insights for commons across Dependabot, CodeQL, and OpenSSF Scorecard.

This updates vulnerable Go deps in root and cmd/hx modules, redacts sensitive headers in curl trace output, enforces trace log redaction, and removes deterministic fingerprints from long-secret redaction output.

Workflow tokens are restricted to read-by-default, Scorecard now runs on master, and the Scorecard action is updated.

Branch-Protection, Code-Review, and Signed-Releases require GitHub repository settings / release policy changes outside this PR.

coderabbitai · 2026-07-03T14:03:57Z

Warning

Review limit reached

@adityathebe, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1ebf6d73-2d69-44b7-b893-ed4f5dc6fee2

📥 Commits

Reviewing files that changed from the base of the PR and between 516bc6d and e5e545d.

⛔ Files ignored due to path filters (2)

cmd/hx/go.sum is excluded by !**/*.sum
go.sum is excluded by !**/*.sum

📒 Files selected for processing (14)

.github/workflows/hx-test.yml
.github/workflows/lint.yml
.github/workflows/release.yml
.github/workflows/scorecard.yml
.github/workflows/test.yml
cmd/hx/go.mod
go.mod
http/client.go
http/curl.go
http/curl_test.go
http/http_test.go
logger/default.go
logger/sanitize.go
logger/sanitize_test.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/security-insights

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/security-insights

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-07-03T14:04:06Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/ulikunitz/xz@v0.5.12 ⏵ v0.5.15		⁺²
	golang.org/x/term@v0.40.0 ⏵ v0.44.0
	go.opentelemetry.io/otel/exporters/stdout/stdouttrace@v1.35.0 ⏵ v1.44.0

View full report

socket-security · 2026-07-03T14:04:08Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: golang `golang.org/x/tools` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `golang/github.com/prometheus/common@v0.67.5` → `golang/github.com/onsi/ginkgo/v2@v2.28.0` → `golang/github.com/onsi/gomega@v1.39.1` → `golang/github.com/samber/lo@v1.53.0` → `golang/github.com/flanksource/clicky@v1.21.1` → `golang/golang.org/x/crypto@v0.53.0` → `golang/github.com/kr/pretty@v0.3.1` → `golang/golang.org/x/tools@v0.45.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/tools@v0.45.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-07-03T14:06:17Z

Gavel summary

Source	Pass	Skip	Duration
collections	49	0	3.0s
files	41	0	79ms
github.com/flanksource/commons/certs	4	0	320ms
github.com/flanksource/commons/cmd/hx	8	0	-
github.com/flanksource/commons/cmd/hx/parse	26	0	-
github.com/flanksource/commons/collections/syncmap	10	0	-
github.com/flanksource/commons/context	1	0	-
github.com/flanksource/commons/duration	2	0	-
github.com/flanksource/commons/files	16	0	-
github.com/flanksource/commons/har	30	0	-
github.com/flanksource/commons/hash	13	0	-
github.com/flanksource/commons/http	95	2	9.5s
github.com/flanksource/commons/logger	49	0	-
github.com/flanksource/commons/logger/httpretty/internal/color	15	0	-
github.com/flanksource/commons/logger/httpretty/internal/header	1	0	-
github.com/flanksource/commons/lookup	7	0	-
github.com/flanksource/commons/test	5	1	10ms
github.com/flanksource/commons/text	1	0	-
github.com/flanksource/commons/tokenizer	3	0	-
logger	41	0	2ms
set	7	0	382.049µs

Totals: 424 passed · 0 failed · 3 skipped · 12.9s

View full results

Update vulnerable Go dependencies in the root module and hx command, including OpenTelemetry, go-jose, x/crypto, x/net, and xz, so govulncheck reports no findings. Redact sensitive HTTP headers in curl trace output, enforce redaction at the Tracef boundary, avoid over-redacting non-secret trace fields, and remove deterministic hashes from long-secret redaction output. Tighten GitHub workflow token permissions, run Scorecard on master, update the Scorecard action, and keep CI stable by avoiding duplicated gavel linting and external httpbin header tests.

adityathebe force-pushed the fix/security-insights branch from 5b5e033 to 8a50906 Compare July 3, 2026 14:05

adityathebe requested a review from moshloop July 3, 2026 14:06

github-advanced-security AI found potential problems Jul 3, 2026

View reviewed changes

Comment thread logger/default.go Fixed

Comment thread logger/sanitize.go Fixed

adityathebe force-pushed the fix/security-insights branch 3 times, most recently from cb5a119 to caaa049 Compare July 3, 2026 14:55

adityathebe force-pushed the fix/security-insights branch from caaa049 to e5e545d Compare July 3, 2026 14:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: remediate security insights#325

fix: remediate security insights#325
adityathebe wants to merge 1 commit into
masterfrom
fix/security-insights

adityathebe commented Jul 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

Review limit reached

Uh oh!

socket-security Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

adityathebe commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

socket-security Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Gavel summary

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

adityathebe commented Jul 3, 2026 •

edited

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

socket-security Bot commented Jul 3, 2026 •

edited

Loading

socket-security Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading