kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M5b spec: refuse PGP private key blocks too

Browse Source 
The private-key rule named only PEM's ending, so an armored PGP
private key passed. Public-key blocks still pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-26 03:37:31 -07:00
co-authored by Claude Opus 5.5
parent ed4cef9ec5
commit ebadc8250e
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/2026-09-26-m5b-hardening.md
+2 -1
View File
@@ -118,7 +118,8 @@ A text holding any of these is refused, with the rule's name:
(`sk-learn` is not a key): GitHub (`ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`, `github_pat_`),
GitLab (`glpat-`), `sk-` followed by at least 20 key characters, Slack (`xox` then one of `b`,
`a`, `p`, `r`, `s`, then `-`), AWS access keys (`AKIA` or `ASIA` then 16 upper-case letters or
digits), and private-key blocks (a line starting `-----BEGIN` and ending `PRIVATE KEY-----`).
digits), and private-key blocks (a line starting `-----BEGIN` and ending `PRIVATE KEY-----`,
or, for PGP's armor, `PRIVATE KEY BLOCK-----`; public-key blocks pass).
- The chat-template tags (6.2's list), in memory writes only: memory refuses them outright, which
is stricter than neutralising (M5a rule, kept).