From ec9977c8c232c65d5e0a4032a846c71e9c6b2d1a Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Sat, 29 Aug 2026 10:23:24 +0000
Subject: [PATCH] Stop the vault fixtures looking like real secrets

The OpenCreds test fixtures used an `sk_live_` prefixed token and PEM
private-key headers. All placeholders, none real, and the scanners here
happened not to fire on them -- but the reference implementation's
ThreatCrush run did flag the equivalent strings, and it was right to.

A fixture only has to exercise the field. A real-looking live-key prefix
or private-key header sitting in the tree trains both the scanner and
the people reading its output to shrug at exactly the shape that
matters.

149 vault tests still pass, interop included.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRQrfuwuYKKV5UB9kLHuX5
---
 packages/vault/__tests__/opencreds-interop.test.js | 4 ++--
 packages/vault/__tests__/opencreds.test.js         | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/vault/__tests__/opencreds-interop.test.js b/packages/vault/__tests__/opencreds-interop.test.js
index 036676e..4ec7a63 100644
--- a/packages/vault/__tests__/opencreds-interop.test.js
+++ b/packages/vault/__tests__/opencreds-interop.test.js
@@ -74,11 +74,11 @@ function payloadFrom(impl) {
       impl.createItem('note', { name: 'WiFi', notes: 'the password is on the router' }),
       impl.createItem('key', {
         name: 'deploy@railway',
-        key: { keyType: 'ssh', algorithm: 'ed25519', privateKey: '-----BEGIN-----', path: '~/.ssh/id_ed25519', mode: '0600' },
+        key: { keyType: 'ssh', algorithm: 'ed25519', privateKey: '<private key body>', path: '~/.ssh/id_ed25519', mode: '0600' },
       }),
       impl.createItem('account', {
         name: 'Stripe',
-        account: { provider: 'stripe', accessToken: 'sk_live_x', scopes: ['charges:write', 'customers:read'] },
+        account: { provider: 'stripe', accessToken: '<access token>', scopes: ['charges:write', 'customers:read'] },
       }),
     ],
   };
diff --git a/packages/vault/__tests__/opencreds.test.js b/packages/vault/__tests__/opencreds.test.js
index bd26514..4e4f678 100644
--- a/packages/vault/__tests__/opencreds.test.js
+++ b/packages/vault/__tests__/opencreds.test.js
@@ -54,11 +54,11 @@ function samplePayload() {
       createItem('note', { name: 'WiFi', notes: 'on the router' }),
       createItem('key', {
         name: 'deploy',
-        key: { keyType: 'ssh', privateKey: '-----BEGIN-----', path: '~/.ssh/id_ed25519', mode: '0600' },
+        key: { keyType: 'ssh', privateKey: '<private key body>', path: '~/.ssh/id_ed25519', mode: '0600' },
       }),
       createItem('account', {
         name: 'Stripe',
-        account: { provider: 'stripe', accessToken: 'sk_live_x', scopes: ['charges:write'] },
+        account: { provider: 'stripe', accessToken: '<access token>', scopes: ['charges:write'] },
       }),
     ],
   };
@@ -82,7 +82,7 @@ describe('the six item types', () => {
     const userKey = randomBytes(32);
     for (const item of [
       createItem('key', { name: 'deploy', key: { keyType: 'ssh', privateKey: 'SECRET' } }),
-      createItem('account', { name: 'Stripe', account: { accessToken: 'sk_live_x' } }),
+      createItem('account', { name: 'Stripe', account: { accessToken: '<access token>' } }),
     ]) {
       const row = await encryptItem(userKey, item);
       expect(row.type).toBe(ITEM_TYPE[item.type]);
@@ -134,7 +134,7 @@ describe('exporting', () => {
     const raw = JSON.stringify(db);
     expect(raw).not.toContain('hunter2');
     expect(raw).not.toContain('4242424242424242');
-    expect(raw).not.toContain('sk_live_x');
+    expect(raw).not.toContain('<access token>');
     // The counts are readable without the passphrase, for a preview.
     expect(db.manifest.itemCount).toBe(6);
   });