SOURCES

Incident Mechanism

1. A tool-tracing decorator recorded every tool kwarg with str(value) into a span attribute. It was harmless while no kwarg object held a secret.
2. Much later, a refactor moved the shared secret from a lazy environment read onto a dataclass field of the RPC client, without field(repr=False). The client was passed to tools as a kwarg.
3. The generated __repr__ included the secret, and the decorator wrote it into spans.
4. The fix added field(repr=False) to the credential fields and a test that runs sentry_sdk.serializer.serialize over the client and asserts the secret is absent.

Neither change looked dangerous in its own diff, and the sink was already on the default branch when the field was added.

Source-Backed Decisions

1. Report the holder without a proven sink.
   • Reason: the sink predated the field and lived in another module.
   • Decision: an unexcluded credential field is medium when instances leave the module and no sink is found, and high when a sink is found anywhere in the repository.
2. Report the sink without a proven credential input.
   • Reason: the wholesale str(value) sink was harmless until an unrelated change.
   • Decision: a wholesale sink without an allowlist is medium on its own.
3. Search beyond the diff and do not downgrade for it.
   • Reason: diff-only review marked each half safe, and consumers commonly publish only high findings.
   • Decision: the investigation greps the repository for the other side, and severity follows what it finds.
4. Treat partial exclusion as a finding.
   • Reason: repr=False is the reflexive fix and does not cover asdict, __dict__, or pickle.
   • Decision: severity follows the unblocked path.
5. Name the sink’s serializer in the regression test.
   • Reason: a repr check alone misses __dict__-based serializers.
6. Do not treat a single Pydantic field flag as exclusion.
   • Reason: a review treated Field(exclude=True) as complete. On Pydantic 2.11, str(model) and repr(model) still contain that field, which is the span path this skill targets. Field(repr=False) still appears in model_dump. Setting both flags covers those paths and does not clear __dict__.
   • Decision: accept Field(repr=False, exclude=True) together, or SecretStr / SecretBytes, as fully excluding generated paths. Report either flag alone at the severity of the unblocked path.
7. Treat raw attribute access as a sink, not as a generated path.
   • Reason: a follow-up review found the skill both accepted Field(repr=False, exclude=True) and called a leftover __dict__ path partial. Every stored attribute is in __dict__, so counting it as a generated path would make every field-level mechanism, including the incident’s repr=False fix, fail.
   • Decision: judge holders by generated paths only. Report vars, __dict__, pickle, and default=vars as a raw attribute sink finding when they receive a credential-bearing instance, whatever its field flags or wrapper.
8. Report a partial exclusion only when a sink uses the unblocked path.
   • Reason: the report table required a sink while the severity table also listed a sinkless low partial exclusion. The incident eval expects no findings for repr=False fields with only a repr-based sink.
   • Decision: drop the sinkless low case.

Evaluation Runs

Warden pi runtime, openrouter/x-ai/grok-4.5, effort high, against the original internal repository.

Observations:

1. With comma-delimited allowed-tools, the same incident run produced only 2 medium findings: the agent had no read or grep, so it could not trace the sink. Fixed by switching to space-delimited tools.
2. Call-site hunks that pass a credential into the constructor produce extra findings for the same field. Warden analyzes hunks independently, so a per-hunk dedupe instruction did not help and was removed. These are duplicates, not false positives.
3. Substring name matching did not cause false positives on LLM token counters in this run, so the name list was left unchanged.

Open Gaps

• Sample size is one positive and two negative cases on one model. Add more negative diffs, such as OAuth request models that legitimately serialize a token into an outbound request body, before relying on precision.
• Not yet run on Claude models.
• Add Go, Java, or Rust references only if findings in those languages recur.