mirror of https://github.com/garrytan/gstack.git
75e6ca2989
The browse `storage` command dumps all localStorage and sessionStorage as JSON. This can expose tokens, API keys, JWTs, and session credentials in QA reports and agent transcripts. Fix: redact values where the key matches sensitive patterns (token, secret, key, password, auth, jwt, csrf) or the value starts with known credential prefixes (eyJ for JWT, sk- for Stripe, ghp_ for GitHub, etc.). Redacted values show length to aid debugging: [REDACTED — 128 chars] |
||
|---|---|---|
| .. | ||
| bin | ||
| src | ||
| test | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||