fix(security): redact secrets in npu_client log, bound ReDoS regexes

[mrveiss]

Thinking Path

Fetched origin/main at the merge commit for #17077 (928573e3bb), then pulled the actual CodeQL SARIF for that PR's Python analysis (refs/pull/17077/merge, analysis id 1803753251, 3 results) rather than trusting only the alert summary — the org-wide /code-scanning/alerts endpoint hadn't indexed these yet (main's CodeQL scan for this exact commit hasn't run), so the SARIF was the only way to get the precise CodeQL data-flow trace and confirm these are real, not fabricated line/rule mappings.

The SARIF flow for Finding 1 showed generate_embedding_with_fallback's text parameter is reachable, at npu_client.py:471, both from a redacted fact-content path and (confirmed separately by grepping callers) from several unredacted callers (work_intent_similarity.py, semantic_search.py, vector_search_engine.py, code_intelligence/*) — so this isn't CodeQL missing an existing sanitizer, it's a genuine gap for callers that don't pre-redact.

For Findings 2/3, read both flagged regexes (_PEM_BLOCK_RE, _DATA_URI_RE) and reasoned through the backtracking: both have an unbounded quantifier ([\s\S]*?, [^,\s]+) that gets retried from every occurrence of the pattern's own anchor literal in adversarial input with no closing marker — O(n^2). Fixed by bounding both quantifiers to generous-but-finite limits, then verified empirically (see Verification) rather than assuming correctness.

What Changed

• autobot-backend/services/npu_client.py: generate_embedding_with_fallback's failure-path error log now redacts text via autobot_shared.secret_redaction.redact_content() before truncating to 80 chars, instead of logging the raw caller-supplied prefix (CodeQL py/clear-text-logging-sensitive-data). Reused the existing security(secrets): credential redaction is name-keyed and cannot see credentials in free text — add content scanning before mail is indexed #13708 redaction utility rather than writing new masking logic, per repo convention.
• autobot_shared/secret_redaction.py: bounded the two regex quantifiers CodeQL flagged as polynomial-ReDoS-vulnerable (py/polynomial-redos):
  • _PEM_BLOCK_RE: header class capped at 40 chars (real PEM key-type headers are well under 12), body capped at 16384 chars (~5x a real 4096-bit RSA key body, ~2.5x an 8192-bit one).
  • _DATA_URI_RE: media-type span capped at 255 chars (real MIME types, even long ones, are well under that).

Verification

• Reconstructed both regexes standalone (not importing repo code) and ran every _TRUE_POSITIVES/_FALSE_POSITIVES fixture from secret_redaction_test.py through old vs. new: all 16 cases match (old == new match presence for every fixture, for both regexes) — no behavior change for real credentials or ordinary text.
• Benchmarked the new bounded PEM regex against adversarial input ("-----BEGIN PRIVATE KEY-----" * n, no closing marker) at n=2500/5000/10000/20000: time scales linearly with input size (roughly doubles when input doubles), confirming the fix changes the complexity class from O(n^2) to O(n) rather than just shrinking the constant.
• Did not run the repo's own test suite locally per policy; instead let the pre-push hook run it — pytest on autobot_shared/secret_redaction_test.py passed on push, independently confirming the equivalence analysis above.
• Confirmed via gh api that generate_embedding_with_fallback has unredacted callers beyond the fact-content path, so Finding 1 is a real gap, not a CodeQL false positive against an already-sanitized value.

Residual note (not fixed here, out of scope for this PR): the direct callers of redact_content/scan_content_for_credentials via knowledge_graph_routes.py → pipeline/runner.py have no upstream content-length cap (unlike the bulk.py fact-content path, which caps at 100000 chars) — so a very large adversarial document on that path would still take non-trivial (linear, not quadratic) time. Flagging for awareness; happy to file a follow-up issue if wanted.

Single-issue rationale

Both fixes are the direct, minimal remediation for the 3 CodeQL alerts introduced by the same merge (#17077) and land together because they're the same security gate blocking main — no unrelated changes bundled in.

Model Used

Claude Sonnet 5

[coderabbitai]

Warning

Review limit reached

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 26f628b3-b60d-49b9-aa5c-a6c7f99e5de4

📥 Commits

Reviewing files that changed from the base of the PR and between 928573e and b5d9c38.

📒 Files selected for processing (2)

• autobot-backend/services/npu_client.py
• autobot_shared/secret_redaction.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(agents): agent-terminal sessions act only for their owner; agent commands report real output and exit codes (#17052, #17074) #17106 fix(agents): agent-terminal sessions act only for their owner; agent commands report real output and exit codes (security(terminal): command approvals take the approver from the request body/WS payload (or record none) — a command's run is approved by a forgeable identity #17052, bug(agent-terminal): the command poll never sees agent output (sender mismatch), and a timed-out command is reported SUCCESS/EXIT_CODE 0 from a freshly recreated shell #17074)
• fix(media): parse office and ODF documents instead of plain-texting them (#16784) #17103 fix(media): parse office and ODF documents instead of plain-texting them (fix(media): the document pipeline plain-texts verified office formats instead of parsing or refusing them #16784)
• fix(security): audit #13708 redaction-test fixtures into secrets baseline #17102 fix(security): audit security(secrets): credential redaction is name-keyed and cannot see credentials in free text — add content scanning before mail is indexed #13708 redaction-test fixtures into secrets baseline
• fix(ci): prune stale 0.0.0.0:11434 baseline entries (SSOT Configuration Compliance) #17101 fix(ci): prune stale 0.0.0.0:11434 baseline entries (SSOT Configuration Compliance)
• test(audit): commit the filing-token leak-check, add rotation doc (#13859) #17100 test(audit): commit the filing-token leak-check, add rotation doc (audit worker files issues via ambient gh CLI auth — no vault-owned credential, no revocation path #13859)
• fix(slm): shared TLS cert on vnc/redis-only nodes + persistent service-restart cap (#16020, #16712) #17096 fix(slm): shared TLS cert on vnc/redis-only nodes + persistent service-restart cap (nginx cannot start on a node with no TLS cert: five roles consume the shared keypair, four provision it #16020, bug(slm): the reconciler's service-restart cap lives in memory, so it resets on every SLM restart and retries a failing service forever #16712)
• chore(train): batch vehicle 2 — 4 approved PRs (#17093, #17094, #16896, #16899), one CI run #17095 chore(train): batch vehicle 2 — 4 approved PRs (fix(kb): share_facts routes through the canonical ownership index (#16709) #17093, fix(i18n): route TranscriberLayout's settings labels through vue-i18n (#16335) #17094, security(api): gate captcha, metrics and diagnostics routers (#16375) #16896, security(ai-ml): pin HuggingFace model revisions and verify weight integrity (#13034) #16899), one CI run
• security(models): pin 3 unpinned HF loads, widen bandit to npu-worker (#17087) #17088 security(models): pin 3 unpinned HF loads, widen bandit to npu-worker (security(models): 3 more unpinned HF from_pretrained() call sites missed by #13034 and invisible to CI's bandit gate #17087)
• chore(train): batch vehicle — 11 approved independent PRs, one CI run #17086 chore(train): batch vehicle — 11 approved independent PRs, one CI run
• refactor(approvals): unify the general and LLC approval systems (#17043, #17056) #17072 refactor(approvals): unify the general and LLC approval systems (refactor(approvals): consolidate the general and LLC approval systems into one platform approval service with optional company scope (#17038) #17043, fix(approvals): approval-gate comments are recorded as author_type=human whoever the caller is #17056)
• chore(deps): bump the uv group across 1 directory with 2 updates #17066 chore(deps): bump the uv group across 1 directory with 2 updates
• feat(backend): orphan-storage detector framework + code-source clone detector (#17038, #17039) #17050 feat(backend): orphan-storage detector framework + code-source clone detector (Umbrella: SLM Data hygiene page — detect and safely clean up orphaned data across services #17038, feat(backend): orphan-storage detector framework + code-source clone detector, delete through the owning service (#17038) #17039)
• chore(vehicle): land WebSocket auth stack — 4 approved PRs (#16891, #16939, #17018, #17027) #17048 chore(vehicle): land WebSocket auth stack — 4 approved PRs (security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (#16457) #16891, security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457) #16939, fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (#17009, #17010) #17018, fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (#17017) #17027)
• chore(vehicle): land CI & hooks infra — 6 approved PRs (#16938, #17032, #16952, #16958, #16882, #16959) #17047 chore(vehicle): land CI & hooks infra — 6 approved PRs (fix(ci): chain formatter dispatch after the branch guard in pre-commit (#16923) #16938, chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (#17029) #17032, fix(tests): prune SKIP dirs during the walk, not after rglob returns (#16601) #16952, test(security): a delegated subagent runs a write its parent is held from (#16950) #16958, security(infra): stop binding ChromaDB to every interface by default (#15317) #16882, fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959)
• security(kb): re-scope #16985 to a guard -- every connector already reaches store_fact #17016 security(kb): re-scope security(secrets): wire credential redaction into the remaining 11 KB connectors (#13708 follow-up) #16985 to a guard -- every connector already reaches store_fact
• feat(agents): one-shot idle notice (#16949) #17015 feat(agents): one-shot idle notice (feat(agents): subscribe once to be told when a peer is next idle #16949)
• feat(ci): add an open-PR cap to the pre-push gate (#17006) #17008 feat(ci): add an open-PR cap to the pre-push gate (Open-PR cap: refuse new-branch pushes at/above AUTOBOT_OPEN_PR_CAP (default 40) #17006)
• fix(agents): the peer channel delivers to the recipient, not the sender; broadcast reaches every other agent (#16986) #17001 fix(agents): the peer channel delivers to the recipient, not the sender; broadcast reaches every other agent (agents: the peer channel never delivers to the recipient — a request lands in the sender's own inbox and the sender answers itself #16986)
• feat(agents): peer-to-peer messaging and idle notice (#16948, #16949) #16996 feat(agents): peer-to-peer messaging and idle notice (feat(agents): deliver peer messages at the recipient's next turn, not mid-task #16948, feat(agents): subscribe once to be told when a peer is next idle #16949)
• fix(test): give result.metadata a real dict in 3 multimodal perf/scalability mocks (#16990) #16995 fix(test): give result.metadata a real dict in 3 multimodal perf/scalability mocks (bug(test): 3 multimodal performance/scalability tests fail — metadata Mock lacks __setitem__ since #15234 #16990)
• feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (#16040, #16294, #16999) #16989 feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (API key scopes are stored and displayed but never enforced — keys inherit full user authority #16040, feat(auth): decide which routes accept API keys, and wire X-API-Key through the #16040 mechanism #16294, docs(api): the public API docs tell integrators to send a user API key to the main backend, which accepts none #16999)
• feat(agents): capture a terminal session's tenant at creation (#16975) #16978 feat(agents): capture a terminal session's tenant at creation (feat(agents): capture a terminal session's tenant at creation — it cannot be recovered afterwards #16975)
• feat(security): bound every Company OS run by its org role, per adapter (#16950) #16974 feat(security): bound every Company OS run by its org role, per adapter (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(deploy): the user-frontend build sites publish through a staged swap (#15603) #16970 fix(deploy): the user-frontend build sites publish through a staged swap (bug(deploy): the user-frontend build sites still publish their own failures, and three SLM build sites sit outside the shared staged publish #15603)
• fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (#16957, #16950) #16969 fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (security(a2a): three of four trust-matrix capabilities are enforced nowhere — a level that denies them denies nothing #16957, security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• feat(agents): live presence registry, one query across all three agent kinds (#16947) #16965 feat(agents): live presence registry, one query across all three agent kinds (feat(agents): live presence — one registry of named agents with busy/idle state, across all three kinds #16947)
• fix(security): match injection patterns against what a model reads, not the raw text (#16354) #16937 fix(security): match injection patterns against what a model reads, not the raw text (security(detector): detect_injection matches its patterns before stripping invisible Unicode, so a zero-width character inside a phrase defeats the match #16354)
• fix(ci): python-paths covers the shell wrappers python-suite tests (#16249) #16892 fix(ci): python-paths covers the shell wrappers python-suite tests (python-paths: a change to only check-pre-commit-hook-pr.sh skips the tests that exercise it #16249)
• fix(ci): give the SLM backend's tests their own venv in CI (#16394) #16889 fix(ci): give the SLM backend's tests their own venv in CI (ci: run SLM backend tests in their own venv, so CI stops forcing the backend's websockets<16 cap onto the SLM #16394)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[mrveiss]

Carried by #17116 (cb492ba0e314fb0744d47c709e8cdfbae255374c). Closing as superseded, branch kept.