v0.0.159

security/leaked-secrets is more precise and harder to talk around: an admin-named hosted-search key reports at high with a hint (William's #1523 for #1515, with an overlapping maintainer draft, #1524, folded in), a header-only Bearer JWT, a JWT-shaped string that does not decode and an AMD or RequireJS module path are no longer reported as credentials, and a real token with a missing alg, an oversized part or a decoy in front still reports. The integrity rules count an unread control once, read a style attribute and a CSS rule to larger bounds, say so when a rule is too large to read, and resolve a relative link by the page's first <base href> as a browser does.

Fixed

• security/leaked-secrets no longer reports an AMD / RequireJS module path whose words are all known as a credential. A module path such as Magento_Customer/js/change-email-password under a credential-named key was reported as a generic secret. A value of segments joined by / is now a name when every word (at most three per segment, camelCase parts and plurals included) is in a list of module-path words, it has a Vendor_Module head or a js segment, and no segment has more than two digits or three capitals. A path with a word outside the list reports as before, so some real module paths still report; a drawn run of letters is not a word, so random values with a / still report. Trade-off: a passphrase made only of listed words in that shape can be suppressed. (#1292)
• security/leaked-secrets no longer reports a header-only JWT after Bearer. Bearer eyJhbGciOiJIUzI1NiIs, the header segment of a JWT with no dot, payload or signature, was reported as a medium bearer token. It is dropped only when the whole value decodes to a complete JOSE header (a JSON object with an alg and only JOSE header keys), or is a short truncated one (64 characters or fewer, cut mid-JSON, opening with alg, typ, kid or cty), and the text after it does not continue a token. An opaque JSON bearer value that merely opens with one of those keys, a JWT written with a %2E, space, comma or escaped separator, and a full Bearer <JWT> still report. (#1227)
• security/leaked-secrets stops reporting strings that only look like a JWT. A JSON Web Token match was kept as a generic JWT-shaped string at medium when it did not decode. It is now dropped only on proof: a header or payload within the 8,192-character read bound that is not a JSON object (garbage, truncated, trailing bytes, an array, a string, a number or null; a header within the bound that is not valid JSON counts as proof, one past the bound does not), or a header object with no string alg over a payload that is only a plain generic token. A part past 8,192 characters, nested too deeply to parse or empty still reports, and a header with no string alg keeps the classification its payload earns (service_role, an admin scope, Supabase, Hygraph, Shopify). Known limit (#1530): two decoy eyJ… segments in a row before a real token consume its payload, and the match is dropped; one decoy is handled. (#1283)
• The integrity rules no longer pass three bounds in silence. A hidden decoy after more than 8,192 characters of style attribute was read as visible and broke the label's phrase; a style attribute is now read to 1 MB (once per element), and a control with a longer one is counted in controlsUnread. A CSS rule with a body over 4,000 characters or a selector over 300 was skipped whole, hiding an overlay rule behind cheap padding; rules are now read up to 256 KB and a 2,048-character selector, and a larger rule that could match an iframe on the page makes the CSS cssTruncated. A link or form resolved against a <base href> on another host is now judged by that host (and a relative iframe src resolves against it), where it was judged as the page's own site; a selector list is read per part (a list over 2,048 characters of short parts no longer hides the matching one), an oversized part, prelude or hidden-class rule gives cssTruncated or hiddenCssTruncated, links are ranked as off-site under a moved base, a <base> inside svg, math, noscript or template is ignored (one inside <foreignObject> is honoured), an empty link href goes to the base, and the base is found once per document in one linear pass with no depth bound (a page of 30,000 iframes or 80,000 nested <base> elements stays linear, and nesting depth never decides which base wins). (#1423)
• integrity/brand-impersonation counts a control once in controlsUnread. A control that hit more than one bound (an attribute over 16,000 characters, more cue windows than the cap, a text read cut at its visit allowance) was counted once for its attributes and again for its text read, so details.controlsUnread could exceed the page's controls. Each control now counts at most once; controls cut by the prepared-controls cap or the logo-alt cap are still counted, and templates past the limit stay in templatesUnread. (#1491)
• security/leaked-secrets distinguishes admin-named hosted-search keys from search-only keys. A 32-character value (Algolia and Typesense shape) under search_admin_api_key, adminApiKey or admin_api_key reports at high, and a master_api_key name at any length; search_api_key stays medium with the search-only hint. Meilisearch masterKey reports at high and searchKey at medium with the hint, only when meili appears in the name or in the 120 characters before it. A placeholder such as YOUR_MASTER_KEY_GOES_HERE is not reported, and a one-word search_apikey name is read as before. See leaked-secrets. (#1515)