Morgan Lunt ff5feaeb7f

code-modernization: never write discovered credential values into findings ...

Legacy systems often contain live credentials, and assessment/findings
files get committed and shared. Previously the security-auditor agent
reported hardcoded secrets verbatim into ASSESSMENT.md and
SECURITY_FINDINGS.md.

- security-auditor: mandatory secret-handling rules — mask all credential
  values (file:line + 2-4 char preview), redact secrets from echoed tool
  output, recommend rotation for anything that looks live
- assess/harden: gitignore-verified SECRETS.local.md quarantine file for
  the per-credential inventory; findings files get masked entries and a
  pointer only
- new --show-secrets flag opts into raw values in the quarantine file
  (and only there)
- README: document the behavior and advise users of earlier versions to
  check for already-committed findings and rotate

2026-06-09 08:47:33 -07:00

..

architecture-critic.md

Add code-modernization plugin

2026-04-24 19:52:02 +00:00

business-rules-extractor.md

Fix code-modernization plugin: align README with commands, fix pipeline gaps

2026-05-11 16:17:59 -07:00

legacy-analyst.md

Add code-modernization plugin

2026-04-24 19:52:02 +00:00

security-auditor.md

code-modernization: never write discovered credential values into findings

2026-06-09 08:47:33 -07:00

test-engineer.md

Add code-modernization plugin

2026-04-24 19:52:02 +00:00