kenryu42/cc-safety-net v2.7.8

on GitHub

Standard mode no longer blocks scp and sftp commands that pass an SSH key with -i, matching the exception already made for ssh.

Fixed

• Fixed standard mode blocking scp and sftp when an SSH private key is given as the -i identity file, such as scp -i ~/.ssh/deploy_key deploy@host:/srv/app/file.tar.gz .. The key authenticates the connection and is never printed, so it is no longer treated as a secret read for any built-in rule, including home-directory rules. (#336)
  • The key stays checked where it can still be exposed: as an scp or sftp source operand, when -S hands it to another program, when an option value swallows the -i (for example scp -X -i ~/.ssh/id_rsa ...), and in -F or -o values such as IdentityFile= or ProxyCommand=. Strict and paranoid modes are unchanged.