fix(security): stop credential/PII leaks at capture, persistence and replay

[Sangaibisi]

Problem

Recorded credentials and PII currently leak on three independent paths:

1. semanticInfo.value carries the RAW value of every field — including passwords. The step's own value is masked to ********, but the semanticInfo object embedded in the same event still contains the cleartext, which is stored in the session log, dumped to the page console (console.log("Sending CUSTOM_INPUT_EVENT:", inputData)), and shipped to the local recorder server.
2. Masking only covers input[type=password]. OTP fields (type=text/tel + autocomplete=one-time-code), credit-card/CVV fields (type=text/number), SSN/IBAN and password-named fields are recorded in cleartext. We verified this with a real recording where a phone number typed into a tel field landed verbatim in the saved .workflow.yaml.
3. High-confidence sensitive matches are persisted as plaintext defaults. variable_identifier deliberately sets suggested_default=None for SSN/credit-card/password matches (confidence ≥ 0.95), but _generate_input_schema overrides that intent — entry['default'] = candidate.value — so the recorded secret is written into the saved workflow file anyway, tagged format: ssn / credit-card.

On replay, input values (including ********-masked and unmasked ones) are logged at INFO and embedded in error reports verbatim on both executor paths.

Fix

Extension (capture):

• new isSensitiveField(): checks type, autocomplete (one-time-code, cc-number, cc-csc, cc-exp, new-password, current-password) and name/id/aria-label/placeholder conventions
• extractSemanticInfo masks the value of sensitive fields — the raw value never enters the event stream
• handleInput masks by isSensitiveField instead of type === 'password' only
• per-event console dumps reduced to event-type-only lines (no payload objects)

Python (persistence + replay):

• _generate_input_schema respects suggested_default=None: sensitive defaults are omitted instead of falling back to the raw recorded value
• new workflow_use/workflow/redaction.py: redact_step_value() masks values whose field hints look sensitive; wired into the semantic executor's input log, ErrorContext.input_value, and the deterministic controller's input log

No behavior change for non-sensitive fields.

Related: #165 (audit findings), #166, #168.

🤖 Generated with Claude Code

---

Summary by cubic

Prevents credential and PII leaks by masking sensitive values at capture, persistence, and replay. rrweb input events now use maskAllInputs, and logs/error reports no longer expose raw secrets; non-sensitive inputs behave the same.

• Bug Fixes
  • Capture (extension): rrweb maskAllInputs; broaden sensitive field detection (type, autocomplete, and name/label hints incl. tel/phone, EN/TR); mask semanticInfo.value and input values; console logs omit payloads.
  • Persistence: _generate_input_schema omits defaults for sensitive types and for sensitive name/context hints; no '********' defaults; these inputs are forced required.
  • Replay: redact_step_value redacts inputs in INFO logs and error reports using hints incl. elementText, elementTag, inputType; applied in the semantic executor, deterministic controller, and error context.

^{Written for commit c075b6d. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="workflows/workflow_use/controller/service.py">

<violation number="1" location="workflows/workflow_use/controller/service.py:142">
P1: Sensitive replay inputs can still be logged verbatim when the selector is generic or uses standard credit-card autocomplete hints, because redaction receives only the action params and its heuristic misses those cases. Passing the matched element's type/autocomplete/name metadata into redaction (and covering the standard hints) would preserve masking for these fields.</violation>
</file>

<file name="workflows/workflow_use/workflow/semantic_executor.py">

<violation number="1" location="workflows/workflow_use/workflow/semantic_executor.py:1535">
P1: Replay of a recorded telephone or `cc-*` credit-card input can still write its raw value to INFO logs and error reports. This call only uses a hint regex that does not inspect the recorded input type/semantic metadata or recognize `tel` and `cc-number`/`cc-csc`/`cc-exp`, so the shared redactor should be extended before relying on it here.</violation>
</file>

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Sensitive replay inputs can still be logged verbatim when the selector is generic or uses standard credit-card autocomplete hints, because redaction receives only the action params and its heuristic misses those cases. Passing the matched element's type/autocomplete/name metadata into redaction (and covering the standard hints) would preserve masking for these fields.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At workflows/workflow_use/controller/service.py, line 142:

<comment>Sensitive replay inputs can still be logged verbatim when the selector is generic or uses standard credit-card autocomplete hints, because redaction receives only the action params and its heuristic misses those cases. Passing the matched element's type/autocomplete/name metadata into redaction (and covering the standard hints) would preserve masking for these fields.</comment>

<file context>
@@ -138,7 +139,8 @@ async def input(
 				await asyncio.sleep(0.5)
 
-				msg = f'⌨️  Input "{params.value}" into element with CSS selector: {truncate_selector(selector_used)} (original: {truncate_selector(original_selector)})'
+				logged_value = redact_step_value(params, params.value)
+				msg = f'⌨️  Input "{logged_value}" into element with CSS selector: {truncate_selector(selector_used)} (original: {truncate_selector(original_selector)})'
 				logger.info(msg)
</file context>

[cubic-dev-ai]

P1: Replay of a recorded telephone or cc-* credit-card input can still write its raw value to INFO logs and error reports. This call only uses a hint regex that does not inspect the recorded input type/semantic metadata or recognize tel and cc-number/cc-csc/cc-exp, so the shared redactor should be extended before relying on it here.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At workflows/workflow_use/workflow/semantic_executor.py, line 1535:

<comment>Replay of a recorded telephone or `cc-*` credit-card input can still write its raw value to INFO logs and error reports. This call only uses a hint regex that does not inspect the recorded input type/semantic metadata or recognize `tel` and `cc-number`/`cc-csc`/`cc-exp`, so the shared redactor should be extended before relying on it here.</comment>

<file context>
@@ -1531,7 +1532,7 @@ async def input_executor():
 			await asyncio.sleep(0.5)
 
-			msg = f"⌨️ Input '{step.value}' into: {target_identifier or step.description or selector_to_use}"
+			msg = f"⌨️ Input '{redact_step_value(step, step.value)}' into: {target_identifier or step.description or selector_to_use}"
 			logger.info(msg)
 			return ActionResult(extracted_content=msg, include_in_memory=True)
</file context>

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[Sangaibisi]

Thanks @cubic-dev-ai — all six addressed in aacf1b7:

• P0 rrweb still carries OTP/card values → maskAllInputs: true. Workflow steps never read rrweb input records (only Scroll/Meta events become steps), so masking everything at the rrweb layer is free and closes the channel completely.
• P1 type=tel not sensitive → tel inputs and phone/telefon/gsm naming now mask at capture; a real phone number leaked into a saved workflow exactly this way.
• P1 redaction misses cc-* autocomplete / generic selectors → the hint pattern now covers cc-number/cc-csc/cc-exp tokens and tel/phone terminology (EN+TR).
• P1 elementText not consulted → hint fields extended with elementText/elementTag/inputType.
• P1 context-detected password (0.85) persisted as default → default omission is now type-based (password/credit-card/SSN/email/phone), not confidence-based; only an already-masked capture may surface as a default.
• 13 unit tests added (tests/test_redaction.py) pinning the masking and default-omission behavior.

[cubic-dev-ai]

Thanks @cubic-dev-ai — all six addressed in aacf1b7:

• P0 rrweb still carries OTP/card values → maskAllInputs: true. Workflow steps never read rrweb input records (only Scroll/Meta events become steps), so masking everything at the rrweb layer is free and closes the channel completely.
• P1 type=tel not sensitive → tel inputs and phone/telefon/gsm naming now mask at capture; a real phone number leaked into a saved workflow exactly this way.
• P1 redaction misses cc-* autocomplete / generic selectors → the hint pattern now covers cc-number/cc-csc/cc-exp tokens and tel/phone terminology (EN+TR).
  ...

@Sangaibisi All six fixes line up with what I flagged, and the code matches your descriptions:

• rrweb maskAllInputs: true — correct call. Since steps only derive from Scroll/Meta events, this closes the rrweb payload channel for free. Keep an eye on the <textarea>/contenteditable case; maskAllInputs covers input elements but not arbitrary rich-text content, though that's outside the P0 scope.
• type=tel + phone naming — isSensitiveField now returns true for type === "tel" and the EN+TR name/label hints. Good.
• cc-* autocomplete tokens — the redaction regex covers cc-number|cc-csc|cc-exp, and the capture side matches the same tokens. Consistent.
• elementText/elementTag/inputType hints — added to _HINT_FIELDS, plus the test_element_text_hint_masks test pins it. Two small notes:
  • elementTag and inputType are in the hint list but the regex only fires on words like cvv/tel/phone — an inputType="text" on a masked-value step won't trip it unless another hint does. Fine on its own; just don't expect it to be the sole signal.
  • test_hotel_is_not_tel correctly guards against the tel substring false positive — nice.
• Type-based default omission — this is the fix that matters most. SENSITIVE_VARIABLE_TYPES covers password/card/SSN/email/phone regardless of confidence, and only an already-masked '********' value surfaces as a default.

One thing I want to flag on the last item: the code is now both type-based and confidence-based, not purely type-based as the message implies. The elif candidate.confidence < 0.95: entry['default'] = candidate.value branch means a non-sensitive high-confidence candidate (≥0.95) with no suggested_default loses its default — before this PR it always got candidate.value. In practice that path is rare (suggested_default is normally set for non-sensitive matches), so the "no behavior change for non-sensitive fields" claim mostly holds, but it's not strictly true. If you want that guarantee airtight, that branch could be narrowed.

Also heads-up: GitGuardian flagged a "Generic Password" at tests/test_redaction.py:63 — that's the 's3cret!'/'4111...' test fixture, a false positive on test data, not a real leak. Worth a one-line suppress/allowlist so the check stays green.

The 13 tests look well-scoped and cover both the masking and default-omission behavior. Nothing blocking from me.

_{Tip: get faster answers by chatting with cubic’s review copilot in the review UI}

[cubic-dev-ai]

1 existing issue remains and no new issues found across 4 files (changes from recent commits).

<sub>Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.

Fix all with cubic | Re-trigger cubic</sub>

[Sangaibisi]

Round-2 review response (force-pushed c075b6d, replacing aacf1b7):

• Hint-based sensitivity: variable_identifier now consults the shared redaction matcher, so a field named password/iban whose value pattern-matched as plain STRING no longer gets its raw value persisted as a default.
• No masked defaults: a captured ******** is no longer written to input_schema.default - defaults are typed verbatim on replay, so it would literally enter eight asterisks into the login field. Sensitive inputs get no default and are forced required.
• mobile/cell vocabulary: capture (extension) and replay (redaction) sides both cover mobile/mobil/cell(ular)/msisdn/cep naming for phone fields that are not type="tel"; \bcep\b is word-bounded so names like "Recep" don't mask.
• GitGuardian: the flagged fixture string was a fake test password; the amend replaces it (and hunter2) with inert non-password-like values and rewrites history so the branch never contains them.

Branch checks: tests/test_redaction.py 20 passed; extension tsc --noEmit clean.