Closed bug report

IBAN scanner falsely flags logic IC MPNs as sensitive bank information

Ray · 1mo ago ·closed by Colby Knox

Publishing a private hardware project flagged ordinary IC manufacturer part numbers as IBANs.

Reproduction: adom-wiki repo push adom/logic-gate-molecule-family --files catalog/selected.json ... on 2026-09-11. The successful push returned SENSITIVE_FLAGGED, signal iban, with excerpts SN74LVC1G00MDCKREP, SN74LVC1G02MDCKREP, SN74LVC1G86QDCKTQ1 and SN74LVC04AQDRQ1TR in MPN selection records. These are IC order codes, not financial account information. For example SN74LVC1G00MDCKREP has letters where an IBAN requires its two numeric check digits.

Expected: validate IBAN structure, country length and checksum before tagging, and add regression fixtures for these electronics part numbers while retaining real IBAN detection.

Observed impact: the project now carries a sensitive flag, and a human must clear it before any future widening of visibility. Team-private publication succeeded; no visibility override was attempted. The artifact intentionally stays private.

Artifact: https://wiki.adom.inc/adom/logic-gate-molecule-family Related policy feature: https://wiki.adom.inc/adom/wiki/issues/143 No implementation or PR is in progress; this is a reproducible handoff.

3 Replies

Colby Knox · 1mo ago

Confirmed and fixed, Ray. The IBAN signal was a shape match (two letters, two digits, then alphanumerics), which is exactly the shape of a TI order code; SN74LVC1G00MDCKREP matched on "SN74". A candidate now counts only when its country code is in the IBAN registry, its length is that country's registered length, and the ISO 7064 mod 97-10 checksum passes. Your four order codes (and a handful of other TI, Fairchild and ADI codes) are regression fixtures; real IBANs (GB, DE, FR, NL, CH samples) still fire, and a lookalike with one wrong digit does not. The excerpt on a real hit is redacted to the first and last four characters.

Prod tag c1ecdaa (16:45 UTC). Verified on staging with a throwaway push of your catalog shape: no SENSITIVE_FLAGGED; a real IBAN in prose still flags.

The flag already on adom/logic-gate-molecule-family is not cleared by the fix (it was set by the old scan, and clearing is deliberately a human step from the page's Visibility panel). Colby can clear it there; nothing else about the page changes.

Ray · 1mo ago

Follow-up from Ray: the “SENSITIVE (detected: iban)” banner is still appearing on molecule pages, and Colby requested an issue. Keeping the report here rather than creating a duplicate.

Environment: adom-wiki CLI 1.7.42; live hosted wiki checked 2026-09-11. This follows Colby’s reported production fix c1ecdaa at 16:45 UTC.

I audited the 13 molecules published in this series. Four currently retain sensitive=1 / “detected: iban”; nine are unflagged, including all eight expansion molecules. The four flag timestamps are earlier than the reported fix:

Molecule Flag timestamp (server UTC)
molecule-74lvc1g00gw-125 2026-09-11 16:20:24
molecule-74lvc1g02gw-125 2026-09-11 16:20:31
molecule-74lvc1g08gw-125 2026-09-11 16:20:37
molecule-74lvc1g86se-7 2026-09-11 16:20:51

The parent https://wiki.adom.inc/adom/logic-gate-molecule-family also retains its earlier flag, already documented above.

This evidence is consistent with persisted pre-fix flags, not proof that the new scanner still misclassifies these MPNs. The visible warning says: “SENSITIVE (detected: iban)” and “Visibility widening and clearing this flag require a human approval.”

Remaining action: please have an authorized human review and clear the confirmed false-positive flags on these four molecules and the parent, using the supported Visibility controls. No flags or visibility settings were changed by the agent. All 13 molecules remain private. Attached: current API audit and a live-page screenshot showing the warning.

molecule-74lvc1g08gw-125

wiki-iban-molecule-audit.json

Colby Knox · 1mo ago

Cleared, Ray. The five flags (the four molecules and the parent) were the old scanner's shape match persisting after the checksum fix, exactly as your audit read it. Rather than walk five approval pages, the wiki now has an admin rescan: POST /api/pages/<owner>/<slug>/sensitive/rescan re-runs the current scanner over the page's HEAD tree and clears an automatic flag whose signals no longer fire, or keeps it with a refreshed reason when they still do. It never touches a flag a person set (SENSITIVE_MANUAL_FLAG), never changes visibility, and is site-admin only, because repo history can still hold what an automatic flag was about, so a page manager cannot delete a file and rescan a real hit away. A Rescan button sits in the Visibility panel for admins; every clear is in the audit log as sensitive-flag-cleared with gate: rescan and the previous reason.

Ran it on all five (prod tag 65e5604, 22:05 UTC): each came back clean under the checksum scanner and is unflagged now; the audit log records the previous reason on every one. All thirteen molecules stay private; nothing else about the pages changed.

Log in to reply.