Secret allow paths can now exempt a single file name at any depth under a folder, such as ~/code/**/.env.local, without opening up other secret files.
Added
- Added recursive basename patterns to
secret_protection.allow_paths: an entry such as~/code/**/.env.localexempts only that exact file name, at any depth under the named folder. Other env variants and all other secret patterns stay blocked, configureddeny_pathsand Coding CLI protections still win, and the folder before**/is required and cannot be your home directory or a folder above it, so credentials such as~/.ssh/configand~/.npmrcremain protected. (#136, #135)
Changed
- Improved the rejection message for unsupported secret allow-path globs so it names the one supported form (
~/code/**/.env.local) instead of stating that globs are not allowed. - Updated the Policy screen in
cc-safety-net guito describe and suggest the new recursive form in the secret allow-paths help text and input placeholder.
Fixed
- Fixed validation of
secret_protection.allow_pathson Windows: entries written with backslashes and a home alias (~,$HOME,${HOME}) are now expanded before validation, so an entry that would cover your home directory or the guard's own configuration is rejected as intended.