From 332d3d8fef0fe59ee5864dd87d679d53287db178 Mon Sep 17 00:00:00 2001 From: Jeffrey Montoya Date: Mon, 28 Sep 2026 12:22:51 -0400 Subject: [PATCH] Update scripts/lib/gateguard-target-class.js Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- scripts/lib/gateguard-target-class.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/lib/gateguard-target-class.js b/scripts/lib/gateguard-target-class.js index f02030a96..dcff8b090 100644 --- a/scripts/lib/gateguard-target-class.js +++ b/scripts/lib/gateguard-target-class.js @@ -215,7 +215,7 @@ const CLASS_CONDENSED_HINTS = { // first-touch denial. Basename and segment rules are exact, never substrings. const SENSITIVE_EXTS = new Set(['.pem', '.key', '.p12', '.pfx']); -const SENSITIVE_BASENAME_PATTERN = /^(\.env($|\.)|id_rsa|id_ed25519|credentials|secrets\.)/; +const SENSITIVE_BASENAME_PATTERN = /^(\.env($|\.)|id_rsa|id_ed25519|id_ecdsa|id_dsa|\.netrc$|\.pgpass$|credentials|secrets\.)/; const SENSITIVE_SEGMENTS = new Set(['auth', 'authn', 'authz', 'security', 'secrets', 'payment', 'payments', 'billing', 'migrations']); const SENSITIVE_PREFIX = '.github/workflows/';