fix: redact flax msgpack evidence (#1409)

* fix: redact flax msgpack evidence

* fix: normalize Flax evidence key paths

* fix: close flax evidence redaction gaps

Redact capability tokens embedded in URL paths and standalone secret-shaped evidence. Stringify non-scalar Flax metadata keys before redaction so extension keys serialize safely.

* fix: broaden GitHub token evidence redaction

* fix: redact remaining flax evidence fields

* fix: redact encoded evidence tokens

* fix: redact URL-safe OpenAI project keys

* fix: harden Flax evidence redaction

* fix: redact Hugging Face access tokens

* fix: harden Flax binary evidence scanning

* fix: redact encoded credential evidence

* fix: bound encoded evidence redaction

Author: mldangelo-oai

CHANGELOG.md

@@ -68,6 +68,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - bound Jinja sandbox safety probes so render amplification fails closed instead of exhausting scanner resources
 - harden structured JSON/YAML/GGUF Jinja template extraction against oversized values, nested containers, and colliding template paths
 - redact capability tokens embedded in network URL path segments
+- redact Flax/JAX MessagePack scanner samples, contexts, key paths, structured fields, metadata, and errors
 - redact secret previews and URL path credentials from metadata scanner findings
 - redact secret-shaped dictionary keys from embedded-secret detector finding contexts
 - redact compound credential names and malformed userinfo URLs in scanner evidence

modelaudit/detectors/network_comm.py

@@ -21,8 +21,9 @@
 _SENSITIVE_PATH_TOKEN_PATTERN = re.compile(
     r"(?i)^(?:"
     r"AKIA[0-9A-Z]{16}|"
-    r"gh[ps]_[A-Za-z0-9]{36}|"
+    r"gh[opsur]_[A-Za-z0-9]{36}|"
     r"github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}|"
+    r"hf_[A-Za-z0-9]{30,}|"
     r"eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_.+/=-]*|"
     r"sk-(?:proj-)?[A-Za-z0-9]{24,}|"
     r"xox[baprs]-[0-9A-Za-z-]{20,}"
@@ -334,6 +335,14 @@ def _is_azure_authority_container(container: str) -> bool:
     return decoded == container and _AZURE_CONTAINER_NAME_PATTERN.fullmatch(container) is not None
 
 
+def _is_azure_container_authority(scheme: str, hostname: str, authority: str) -> bool:
+    return (
+        scheme in _AZURE_AUTHORITY_CONTAINER_SCHEMES
+        and hostname.lower().endswith(_AZURE_STORAGE_HOST_SUFFIXES)
+        and _is_azure_authority_container(authority)
+    )
+
+
 def _redact_path_parameter_tokens(segment: str) -> str | None:
     token_candidate, trailing_delimiters = _split_trailing_path_delimiters(segment)
     decoded = unquote(token_candidate)
@@ -445,9 +454,9 @@ def redact_url_for_finding(url: str) -> str:
     netloc_host = f"{hostname}:{port}" if port is not None else hostname
     netloc = netloc_host
     scheme = parsed.scheme.lower()
-    if scheme in _AZURE_AUTHORITY_CONTAINER_SCHEMES and "@" in parsed.netloc:
+    if "@" in parsed.netloc:
         container, _separator, _host = parsed.netloc.rpartition("@")
-        if _is_azure_authority_container(container):
+        if _is_azure_container_authority(scheme, hostname, container):
             netloc = f"{container}@{netloc_host}"
 
     safe_path = _redact_url_path_tokens(scheme, hostname.lower(), parsed.path)