Triage CodeQL rust/cleartext-logging alerts #11–#14

[joshuaboys]

Summary

Triage of open CodeQL rust/cleartext-logging alerts #11–#14. All four are false positives: taint analysis does not treat kindling’s secret maskers as sanitizers, so already-redacted strings look like cleartext when they hit assert! / println!.

No production leak. KindlingService::append_observation always runs mask_secrets_with_evidence on both the validated and validate: false paths (in-process CLI and daemon). Hook capture runs mask_secrets / filter_content before append, then the service masks again.

Alert dispositions (please dismiss)

Alert	Site	Proposed dismissal	Rationale
#11	crates/kindling/src/hook/filter.rs:275	used in tests	Unit test secret_assignment_is_masked. Interpolated filter_content → mask_secrets output into an assert message. Test no longer interpolates that string.
#12	same file :276	used in tests	Same test, second assert.
#13	crates/kindling/tests/capture_mapping.rs:84	used in tests	Fixture is $ boom + default "Unknown error" — no secrets. Assert no longer interpolates obs.content.
#14	crates/kindling/src/commands/log.rs:103	false positive: redacted before write	CLI human output prints observation.content after append_observation, which always calls mask_secrets_with_evidence. CodeQL sees taint through the masker. Productive path: user asked to log this content; we echo the stored (already-masked) row.

Inline // codeql[…] suppressions were not added.

What changed

• CodeQL model pack at .github/codeql/extensions/kindling-rust/ marks mask_secrets / mask_secrets_with_evidence as log-injection barriers (the sink kind rust/cleartext-logging uses). GitHub default setup auto-detects packs under that directory.
• SECURITY.md: automated-scanning section with this table (next to the existing secret-scanning fixture note).
• Tests: stop using masked/fixture strings as assert format args; add cli_log_echoes_already_redacted_content so the fix: DX hardening - security, error handling, docs #14 path stays pinned.
• Short comments on the maskers and the CLI echo.

How the maskers work

mask_secrets / mask_secrets_with_evidence (crates/kindling-service/src/filter/secrets.rs, hook copy in crates/kindling/src/hook/filter.rs) walk the secret-pattern list and replace matches with [REDACTED] or key=[REDACTED]. Evidence classes never include matched substrings. Service tests already pin api_key=abcdef123456789 → api_key=[REDACTED].

Test plan

• cargo test -p eddacraft-kindling --lib secret_assignment_is_masked
• cargo test -p eddacraft-kindling --test capture_mapping
• cargo test -p eddacraft-kindling --test umbrella cli_log
• cargo test -p kindling-service append_observation_masks_secrets