fix(security): redact secrets in evidence and fix finding ID collisions

- Reduced secret value exposure in evidence from 30 to 8 chars
- Fixed finding ID collisions across 6 agents (sqli, xss, crawler, secrets, tech, api discover)
- All agents now use enumerated counter instead of list.index()
- Fixes secondary information disclosure risk

Author: bot

bugfinder/agents/api/discover.py

@@ -125,8 +125,8 @@ async def execute(self) -> AgentResult:
                 except Exception:
                     continue
 
-        for f in findings:
-            f["id"] = f"api-disc-{findings.index(f)}"
+        for i, f in enumerate(findings):
+            f["id"] = f"api-disc-{i}"
 
         discovered = len(assets)
         secured = sum(1 for a in assets if a["properties"]["status"] in (401, 403))

bugfinder/agents/recon/tech.py

@@ -113,8 +113,8 @@ async def execute(self) -> AgentResult:
                 summary=f"Tech detection failed: {e}",
             )
 
-        for f in findings:
-            f["id"] = f"tech-finding-{len(findings)}"
+        for i, f in enumerate(findings):
+            f["id"] = f"tech-finding-{i}"
 
         tech_names = [t["name"] for t in technologies]
         summary = f"Detected {len(technologies)} technologies: {', '.join(tech_names[:5])}"

bugfinder/agents/secrets/scan.py

@@ -58,14 +58,14 @@ async def execute(self) -> AgentResult:
                                 {
                                     "title": f"Potential Secret Found: {name}",
                                     "description": f"Found potential {name} in {url}. "
-                                    "Value starts with: " + value[:20] + "...",
+                                    "Value starts with: " + value[:4] + "...",
                                     "severity": severity,
                                     "confidence": "needs_review",
                                     "category": "secret_exposure",
                                     "evidence": {
                                         "url": url,
                                         "pattern": name,
-                                        "value_prefix": value[:30],
+                                        "value_prefix": value[:8],
                                         "position": match.start(),
                                     },
                                 }
@@ -85,7 +85,7 @@ async def execute(self) -> AgentResult:
                                     "url": url,
                                     "entropy": he["entropy"],
                                     "pattern": he["pattern"],
-                                    "value_prefix": he["value"][:30],
+                                    "value_prefix": he["value"][:8],
                                 },
                             }
                         )
@@ -104,8 +104,8 @@ async def execute(self) -> AgentResult:
         high = sum(1 for f in findings if f["severity"] == "high")
         summary = f"Found {len(findings)} potential secrets ({critical} critical, {high} high)"
 
-        for f in findings:
-            f["id"] = f"secret-{findings.index(f)}"
+        for i, f in enumerate(findings):
+            f["id"] = f"secret-{i}"
 
         return AgentResult(
             agent_name=self.name,

bugfinder/agents/web/crawler.py

@@ -140,8 +140,8 @@ async def execute(self) -> AgentResult:
                 except Exception:
                     continue
 
-        for f in findings:
-            f["id"] = f"crawl-finding-{findings.index(f)}"
+        for i, f in enumerate(findings):
+            f["id"] = f"crawl-finding-{i}"
 
         statuses = [a["properties"]["status"] for a in discovered_assets]
         accessible = sum(1 for s in statuses if s < 400)

bugfinder/agents/web/sqli.py

@@ -91,8 +91,8 @@ async def execute(self) -> AgentResult:
                     except Exception:
                         continue
 
-        for f in findings:
-            f["id"] = f"sqli-{findings.index(f)}"
+        for i, f in enumerate(findings):
+            f["id"] = f"sqli-{i}"
 
         summary = f"Tested {len(params)} parameters, {len(findings)} potential SQLi issues"
         return AgentResult(

bugfinder/agents/web/xss.py

@@ -99,8 +99,8 @@ async def execute(self) -> AgentResult:
                                 except Exception:
                                     continue
 
-        for f in findings:
-            f["id"] = f"xss-{findings.index(f)}"
+        for i, f in enumerate(findings):
+            f["id"] = f"xss-{i}"
 
         high_count = sum(1 for f in findings if f["severity"] == "high")
         summary = f"Tested {len(findings)} XSS vectors, {high_count} potential issues"