Repository navigation
branch reset prints the branch database_password in its JSON output #235
Description
Activity
I'd like to take this one, could you assign it to me? I've already opened #303 with a fix (adds a
redactBranchhelper that stripsdatabase_passwordfrom the--jsonoutput ofbranch reset,create, andlist). Happy to keep ownership clear.@Abhishek-B-R you already have 3 open issues assigned (limit is 3). Please finish or unassign one before taking another (comment "unassign me" on an issue to release it):
- InsForge#1881 — D_TEST feature flag does not update UI when PostHog finishes loading
- InsForge#1367 — "Create Table form" data lost on page refresh / tab discard
- InsForge#1215 — Duplicate OTP emails sent when re-signing up with a previously deleted email
Reacted by Abhishek B RI'd like to work on this. I've already opened #303 with a fix.
Assigned to @Abhishek-B-R. Thanks for taking this on. You're now at the 3-issue limit.
Your open assigned issues (3/3):
- InsForge#1881 — D_TEST feature flag does not update UI when PostHog finishes loading
- InsForge#1367 — "Create Table form" data lost on page refresh / tab discard
- CLI#235 — branch reset prints the branch database_password in its JSON output
Metadata
Metadata
Assignees
Labels
No labels
What happens
insforge branch reset <name> --jsonreturns the branch object with a plaintextdatabase_password:{ "branch": { "id": "021b880b-...", "organization_id": "ddecefbb-...", "name": "e2e-...", "database_password": "T+rIl1ksws0bSMilsSoVOln/o3r/JVY9yKz1Pj/yCEH4lyO7uPXyh92I+YX3KQNL...", ... } }Why it matters
Command output is the least controlled surface there is. It lands in terminal scrollback, CI logs, and any tooling that captures stdout — none of which treat it as secret-bearing. A credential that arrives this way is copied into places nobody chose.
We hit it because the E2E harness records CLI stdout into its run logs and artifacts. Our redactor masks secrets it is told about, and it had no way to know about this one: the value is generated server-side and first seen in this response. It was written to the artifacts of a public workflow run before we noticed.
Suggestion
Omit
database_passwordfrom the command's output, or mask it the wayai setupmasks the OpenRouter key — that command already returns amaskedKeyand deliberately keeps the raw value out of stdout, so the pattern exists in the codebase.Worth a sweep for the same shape: any command that echoes a project or branch object straight from the API may carry credentials the API includes for other reasons.
branch createandbranch switchreturn adjacent objects.Found while adding branch coverage to the deterministic fixture E2E.