fix(security): audit #16875's i18n authApiKey labels into the secrets baseline (#16942)

[mrveiss]

Closes #16942

Thinking Path

Secret Detection (whole tree) went red on #16916, which touches no locale file. The findings (en.json:9086, ur.json:9086, Secret Keyword) are the second authApiKey key that #16875 added to all 11 locales. The base is red, so every PR that merges main inherits it. That makes this one unblocking PR rather than a fix per PR.

Why only 2 of 11 locales: detect-secrets identifies a finding by (file, type, hashed_secret). In nine locales the new translation hashed to a value already audited in that file. en did not: the new value is "API key" (lowercase k), while the older key is "API Key". Neither did ur ("API کیلید").

They are UI labels, so the fix is the audited baseline. That is the documented mechanism, in docs/developer/RATCHET_BASELINES.md under "The secrets baseline: scan, audit, strip". No plugin, filter or allowlist change, and the UI string is not reworded to dodge the keyword regex.

What Changed

.secrets.baseline only, produced by the documented order on current main:

1. Scan: detect-secrets scan --baseline .secrets.baseline (v1.5.0, the pinned rev).
2. Audit: each new entry was inspected at its line and labelled is_secret: false.
3. Strip: line_number removed from every entry.

The diff looks large (+221/−207), but almost all of it is the rescan reordering entries by current line number, which step 1 always does.

Acceptance criteria

• The rescan lists every finding missing from the audited baseline, and each is inspected. It found exactly two:

  • en.json:9086: Secret Keyword
  • ur.json:9086: Secret Keyword

  They match the two CI findings on fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (#14968) #16916. The scanner found those known positives, so its silence on the rest is a real result, not a scan that never looked.

• Only confirmed non-secrets are labelled, and no line_number remains. Both hashes are recomputed from the visible labels:

  • sha1("API key") = cf678cab…
  • sha1("API کیلید") = 9235d7ec…

  After the strip, entries not labelled is_secret: false = 0, and entries carrying line_number = 0.

• Secret Detection (whole tree) passes on this PR. Pending this PR's own CI run.

Verification

Old and new baselines compared as sets of (file, type, hashed_secret, is_secret, is_verified):

	Entries
committed (main)	1358
this PR	1360
removed	0
added	2, the entries above

Outside results, the only field that changed is generated_at.

Model Used

Claude Opus 5 (claude-opus-5)

Summary by CodeRabbit

• Chores
  • Updated secret-detection baseline records across multiple language files.
  • Refreshed the baseline generation timestamp.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7a7900d0-84ee-4a4a-8dd2-45aedb72290a

📥 Commits

Reviewing files that changed from the base of the PR and between bf3cac7 and 817c5aa.

📒 Files selected for processing (1)

• .secrets.baseline

Included review availability: Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The secrets baseline updates hashed Secret Keyword findings for eleven locale files. It adds, removes, replaces, and reorders entries. The generation timestamp changes to 2026-09-18T05:32:44Z.

Changes

Secret baseline refresh

Layer / File(s)	Summary
Locale findings and generation metadata .secrets.baseline	The baseline updates audited findings for Arabic, German, English, Spanish, Persian, French, Hebrew, Latvian, Polish, Portuguese, and Urdu locale files. The generated_at value is updated.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 817c5

The refresh adds only the two intended audited locale findings and preserves the baseline format required by Secret Detection. The change is ready to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The changes address #16942. The baseline adds the two audited Secret Keyword findings for en.json:9086 and ur.json:9086, and sets both to is_secret: false. The summary states that the rescan f…	Provide the completed Secret Detection (whole tree) result. A successful result is required to confirm full compliance with #16942.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the security baseline update for the i18n authApiKey labels from issue #16875. It accurately describes the main change.
Out of Scope Changes check	✅ Passed	The pull request changes only .secrets.baseline. The added findings, line_number removal, and scan reordering directly support the rescan and audit procedure in #16942. The evidence reports no plu…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The changes address #16942. The baseline adds the two audited Secret Keyword findings for en.json:9086 and ur.json:9086, and sets both to is_secret: false. The summary states that the rescan found no other missing findings, removed all line_number fields, and preserved plugins, filters, allowlists, and UI strings. The remaining changes are scan reordering. However, Secret Detection (whole tree) is still pending, so the final acceptance criterion cannot be confirmed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[mrveiss]

Verified — merge first, ahead of everything that has merged main. main is red on Secret Detection (whole tree) at its head (bf3cac724, conclusion failure), so every branch refreshed from main inherits this red whatever it contains.

A secrets baseline is exactly where a real credential could be waved through, so the diff was checked as sets of findings keyed by (file, type, hashed_secret) rather than as text — the text diff is +221/−207 only because the rescan reorders entries:

	Count
Entries on main	1,358
Entries on this branch	1,360
Added	2
Removed	0
Existing entries whose is_secret flipped	0

The two additions, both Secret Keyword and both is_secret: false:

• autobot-frontend/src/i18n/locales/en.json — "authApiKey": "API key"
• autobot-frontend/src/i18n/locales/ur.json — "authApiKey": "API کیلید"

Both are UI labels. detect-secrets' keyword plugin fires on the key name containing ApiKey, not on anything credential-shaped. Each file already carries an audited entry for an older authApiKey ("API Key", capital K); these second keys hash differently, which is why nine locales matched existing entries and these two did not.

Root cause, for the record: #16875 added a second authApiKey key to all 11 locales without the scan → audit → strip step in RATCHET_BASELINES.md. That PR was blocked in review for an unrelated reason (#16933) and merged anyway. Why its own run did not catch the new finding is not yet established — it may have merged before that run finished, which is itself worth knowing.

[mrveiss]

Closing as a duplicate of #16961, which fixes the same main red with the identical two baseline entries (verified as sets: +2, 0 removed, 0 flipped on both). This one was correct and followed the documented full-rescan procedure — it is closed only because its whole-file reorder (+221/−207) would conflict with #16899 and #16895, which also modify .secrets.baseline, where #16961 adds 21 lines. No fault in the work.

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(security): a delegated agent inherits its parent's authority; the originator survives relays (#16950) #16966 fix(security): a delegated agent inherits its parent's authority; the originator survives relays (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• feat(agents): live presence registry, one query across all three agent kinds (#16947) #16965 feat(agents): live presence registry, one query across all three agent kinds (feat(agents): live presence — one registry of named agents with busy/idle state, across all three kinds #16947)
• feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (#16951) #16964 feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (feat(agents): coordinate agents competing for shared resources — API limits, CPU time, queues #16951)
• fix(ci): audit 2 missing .secrets.baseline entries blocking every PR (#16960) #16961 fix(ci): audit 2 missing .secrets.baseline entries blocking every PR (fix(security): .secrets.baseline on main is missing 2 audited entries, blocking every PR's whole-tree secret scan #16960)
• fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959 fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (bug(kb): the doc-sync commit hook re-embeds every doc into the live KB from any worktree, because its hash cache is per-checkout #16934)
• test(security): a delegated subagent runs a write its parent is held from (#16950) #16958 test(security): a delegated subagent runs a write its parent is held from (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• test(security): the ungated-router list may only shrink, so a new entry fails (#16375) #16955 test(security): the ungated-router list may only shrink, so a new entry fails (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• fix(multimodal): the response says whether a result was stored, and if not, why (#16926) #16954 fix(multimodal): the response says whether a result was stored, and if not, why (bug(multimodal): a tenancy-refused write still returns HTTP 200 success — the persisted flag has no consumer #16926)
• fix(tests): prune SKIP dirs during the walk, not after rglob returns (#16601) #16952 fix(tests): prune SKIP dirs during the walk, not after rglob returns (ci(python-suite): intermittent hang in shard 10 — one of the 223 modules it runs on main (hit #16284 and batch 2b) #16601)
• fix(admin): add the missing adminMenuItems entries for pricing/mcp-servers (#16933) #16944 fix(admin): add the missing adminMenuItems entries for pricing/mcp-servers (bug(admin): the MCP-servers and pricing admin screens merged unreachable — no admin menu entry #16933)
• security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457) #16939 security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (security(websocket): auth token travels in the URL query string, not a header/subprotocol #16457)
• fix(ci): chain formatter dispatch after the branch guard in pre-commit (#16923) #16938 fix(ci): chain formatter dispatch after the branch guard in pre-commit (ci(hooks): no local hook runs black/isort/ruff — formatting is first checked in CI #16923)
• fix(security): match injection patterns against what a model reads, not the raw text (#16354) #16937 fix(security): match injection patterns against what a model reads, not the raw text (security(detector): detect_injection matches its patterns before stripping invisible Unicode, so a zero-width character inside a phrase defeats the match #16354)
• fix(ci): size the trailer gate's fetch to the PR so a release is scanned whole (#16931) #16932 fix(ci): size the trailer gate's fetch to the PR so a release is scanned whole (ci(trailers): the trailer gate cannot see a release promotion — fixed fetch-depth 100 vs 808 commits #16931)
• security(rag): route the chat's RAG path through the content firewall (#16771) #16930 security(rag): route the chat's RAG path through the content firewall (security(rag): the chat RAG path builds the prompt from KB text without the content firewall #16771)
• test(api): stop racing the clock in the last completion test (#16928) #16929 test(api): stop racing the clock in the last completion test (test(api): test_completion_performance races the real clock, the defect #15861 already fixed in its siblings #16928)
• fix(security): break-glass repair of a genuinely unreachable knowledge fact or envelope secret, through each type's own service (#15779, #16940) #16927 fix(security): admin break-glass repair for unreachable null-scope resources (bug(scoping): a null-scope resource is denied to every principal including admin — un-repairable in-app #15779)
• docs(ci): the two PR gates name their importer, because pre-push cannot warn you (#16859) #16922 docs(ci): the two PR gates name their importer, because pre-push cannot warn you (ci(process): PR body requirements are undiscoverable before push — gh --body-file never loads the template, and the gate's author failed it twice #16859)
• fix(backend): resolve 4 duplicate route registrations (#16908) #16918 fix(backend): resolve 4 duplicate route registrations (bug(api): four endpoints are registered twice — the second registration is dead code #16908)
• fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (#14968) #16916 fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (RAPTOR tree nodes are built with an empty source_chunk_ids, so no tree node can cite its sources #14968)
• fix(chat): the init stops at its first await once the component unmounts (#16274) #16911 fix(chat): the init stops at its first await once the component unmounts (fix(chat): ChatInterface's init keeps running after unmount, so a slow-init test crashes a later test's fallback #16274)
• security(ai-ml): pin HuggingFace model revisions and verify weight integrity (#13034) #16899 security(ai-ml): pin HuggingFace model revisions and verify weight integrity (security(models): no revision pinning or weight integrity verification — 18 suppressed B615 findings (#13030) #13034)
• security(api): gate captcha, metrics and diagnostics routers (#16375) #16896 security(api): gate captcha, metrics and diagnostics routers (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• security(secrets): content-scanning credential redactor -- catches a credential in free text (#13708) #16895 security(secrets): content-scanning credential redactor -- catches a credential in free text (security(secrets): credential redaction is name-keyed and cannot see credentials in free text — add content scanning before mail is indexed #13708)
• fix(ci): python-paths covers the shell wrappers python-suite tests (#16249) #16892 fix(ci): python-paths covers the shell wrappers python-suite tests (python-paths: a change to only check-pre-commit-hook-pr.sh skips the tests that exercise it #16249)
• security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (#16457) #16891 security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (security(websocket): auth token travels in the URL query string, not a header/subprotocol #16457)
• fix(ci): give the SLM backend's tests their own venv in CI (#16394) #16889 fix(ci): give the SLM backend's tests their own venv in CI (ci: run SLM backend tests in their own venv, so CI stops forcing the backend's websockets<16 cap onto the SLM #16394)
• fix(hooks): the non-git guards tell invoking a command from naming one (#14144) #16885 fix(hooks): the non-git guards tell invoking a command from naming one (bug(hooks): push guard matches the branch name in argv, so 5 forms reach the protected base unblocked #14144)
• security(infra): stop binding ChromaDB to every interface by default (#15317) #16882 security(infra): stop binding ChromaDB to every interface by default (security(chromadb): the vector store binds every interface in front of four unpatchable advisories, one a pre-auth RCE #15317)
• fix(slm-backend): retain the last five discarded background-task launches (#15524) #16880 fix(slm-backend): retain the last five discarded background-task launches (Discarded asyncio.create_task calls can be garbage-collected mid-flight (12 sites) #15524)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.