fix(security-issue-sync): omit the finder credit, never fall back to anonymous - #1131
Merged
potiuk merged 1 commit intoAug 29, 2026
Merged
Conversation
…anonymous Reconciles apache#1124 with apache#1127, as promised in apache#1127's description. apache#1124 made `anonymous` the fallback for a scanner-sourced finding whose scanner declares no public credit name. apache#1127 then landed the finder-credit policy, whose Rule 2 says the opposite: where there is no named finder, omit the `finder` credit rather than writing a placeholder. Both are on `main`, so the framework currently contradicts itself in three places. Rule 2 wins. It is grounded in an ASF CVE reviewer's feedback on a published batch — "I'm not sure how helpful it is to credit 'anonymous' as finder, just leave it out" — and a `credits[]` carrying only the remediation developer is a complete record, whereas a literal `anonymous` occupies the space a reader scans for attribution and answers nothing. Nothing else about apache#1124 changes: the scanner's public credit name is still written when declared, still emitted with `type: "tool"`, and the confidential product token still never reaches a public surface. Only the no-name-declared branch changes, from writing a placeholder to omitting the row. Grep confirms no `anonymous` fallback remains under skills/, projects/, or tools/. Generated-by: Claude Code (Claude Opus 5)
potiuk
added
family:security
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reconciles #1124 with #1127, as promised in #1127's description.
#1124 made
anonymousthe fallback for a scanner-sourced finding whose scanner declares no public credit name. #1127 then landed the finder-credit policy, whose Rule 2 says the opposite: where there is no named finder, omit thefindercredit rather than writing a placeholder. Both are onmain, so the framework currently contradicts itself in three places.Which one wins
Rule 2. It is grounded in an ASF CVE reviewer's feedback on a published batch — "I'm not sure how helpful it is to credit 'anonymous' as finder, just leave it out" — and a
credits[]carrying only the remediation developer is a complete record, whereas a literalanonymousoccupies the space a reader scans for attribution and answers nothing.What does not change
Everything else from #1124 stands: the scanner's public credit name is still written when declared, still emitted with
type: "tool", and the confidential product token still never reaches a public surface. Only the no-name-declared branch changes — from writing a placeholder to omitting the row.Test plan
prek run --filespasses on all three files, includingmarkdownlint,check-placeholders, and the in-hook lychee (validating the new cross-references intofinder-credit-policy.md). A grep acrossskills/,projects/, andtools/confirms noanonymousfallback remains.🤖 Generated with Claude Code