mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 15:51:30 +02:00
Yogesh OjhaandClaude Opus 5
7a6833a61a
redact_command only recognised -H, which ffuf takes. httpx, katana and nuclei all take -header, so the three tools that actually carry the scan context's credentials wrote them in clear into scan_commands.command, out to the worker's stdout through the executor's "Executing:" line, and back to the browser over the command SSE feed. The flag now covers -H, -header and -headers in both spellings, and the header name no longer has to match a sensitive-looking pattern: the name is kept and the value is always masked, because a custom header called X-Company-Session is exactly as secret as Authorization and the name cannot say which is which. Tokenisation is still a guess on a command rebuilt from argv, so the recorder takes the run's own header values and masks them wherever they land, through redact_recorded() beside the other redactors. run_stage resolves the config before building the recorder so it has them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X5roHYDYzSPRNaTkn8hSkJ