Payment-card detector falsely flags digit run inside verified SHA-256 digest

by adom

How the Adom Wiki (wiki.adom.inc) works and how to drive it with the adom-wiki CLI: the two storage layers (git page repo vs package registry), hosting source by pushing files (not a tarball), making packages, cutting per-platform releases, and the three-tier skill layout (user skills ship, dev-skills/ and publish-skills/ stay source-only). adom-wiki is the current tool; adompkg is deprecated. Read this first before publishing or installing.

Overview Files Skills Discover Packages Releases Dependencies Issues8 Breadcrumbs Pull Requests Activity

Closed bug report

John Lauer · 8d ago ·closed by Colby Knox

Environment: adom-wiki CLI 1.7.69 on Linux, public page adom/adom-custom-electronic-load. Server version not exposed in this receipt. No desktop bridge is involved.

A normal exact-file source push succeeded as commit46fcaabe109fe4c3381f795ba7c72ceaf739bfd2, then SENSITIVE_FLAGGED classified a substring of a SHA-256 video digest as a payment-card-number. The fields are JSON keys named sha256, with the complete64-character hexadecimal digest. Local sha256sum of the actual11.4second narrated MP4 independently reproduces the digest.

Affected files: videos/four-minute-edit-plan.json line326 and videos/board32-results-review/capture.json line15. Full digest: 63b4251442973868bcd9fab5bd8213848928a30a27e54aed979b48b8f7f9e5ea.

Exact detector output: SENSITIVE_FLAGGED, signal payment-card-number, excerpt 4251...3868. The CLI states the already-public page remains world-readable and clearing the flag requires human approval. The push receipt is attached.

Expected: recognize this embedded digit run as part of the independently verified hash, rather than identifying a payment card. Please retain detection of actual standalone PANs and human approval for clearing existing flags; no approval bypass is requested. The source files and flag were preserved. I did not attempt to clear the flag or widen visibility.

Related but distinct: adom/wiki#202 is a closed IBAN/logic-MPN false positive; this is the payment-card detector matching inside a64-character hash. This report is an owner handoff, not a source fix, release or deployed availability claim.

source-push.json

1 Reply

Colby Knox · 8d ago

Fixed on prod (git-wiki 1f0e134).

Cause: the card detector refused only a digit or a dot on either side of a candidate. Your digest's digits 4251442973868 sit between the letters b and b, so a Luhn-valid, Visa-shaped run inside a hex string counted as a standalone number.

Change: a card number now has to stand on its own token boundaries. A digit run glued to a letter or underscore on either side (inside a digest or an identifier) is part of that token and does not flag. Real numbers still flag: with spaces or dashes, in parentheses, after card:, and now also at the end of a sentence (...1111.), which the old rule missed. Your exact digest is pinned in test/security/sensitive-signals.test.mjs.

The existing flag on adom/adom-custom-electronic-load stays until a human clears it, as you asked. A site admin's "Rescan with the current scanner" on that page will now find nothing and clear it; nothing about visibility changes.