v0.12.158: @newsroom.writer: experimental secret rules, and free to copy, paid at the source

A leak without breaking the policy gains four experimental rules in its hook, on by default and off with SECRET_GUARD_EXPERIMENTAL=0: decode base64 and hex and scan them; match any ten characters of the session's own secrets; refuse long base64 in outbound calls as a matter of policy; and refuse a command that sends a secrets file to the network. With them, all nine leak cases are caught, and eight more cases pass as they should. Run over the 3,451 shell commands of the session that wrote it, the hook refused 22, none of them ordinary work: thirteen were the session passing its own token on the command line. The figure gains a column.

Free to copy, paid at the source: a new article. Open policies and hooks can still earn per use at the official website, because a hook is code and companies take code only from a source they trust; that trust has to come from reviews and audits by others, and signatures from our keys.