Secret Spill: Redaction Moved to the Boundary

Status Update · 2026-04-14 · 01:05 PM PT

Status: Resolved.

What changed: Moved redaction into the normalizer's write boundary and made it fail closed on shapes it does not recognize. Nothing gets written to canon un-redacted now.

What broke: A pull-request cohort leaked a live token. The old redaction enumerated known prefixes, so the first unknown shape walked straight through.

Next step: Structured parse over prefix lists — a prefix list is always one unknown vendor behind.

Tags: #security #failure-modes #infra