The release cut writes a well-formed secret or the caller's own identity into public release text. launch ship --changelog-json accepts a host-composed payload whose changelog entries[].text and press_release headline text pass through checkProse (size, structure, CleanProseLine) and the outbound policy (session URL and tool footer only), then writes them to CHANGELOG.md and RELEASE.md unredacted: a GitHub token, an AWS key or the caller's own home path in a line is written to the working tree as public release text, to be committed and published. Found by the security review of lane drainEcho2 (INFO: changelog write path). The launch dry-run scan would refuse the same hard_fail finding in the bundled CHANGELOG.md later, but only after the file is written, and a person reviewing the diff may commit it first. Fix direction: at the cut, scan the rendered changelog section and release page with the canonical scanner and refuse any hard_fail finding with a reason naming the kind and the line, never the matched text; a degraded scanner is a stop, as checkOutbound's is. Detector: a payload carrying a well-formed token in a changelog line or a headline is refused, nothing is written, and the refusal does not carry the token.

Frontmatter

.abcd/work/issues/resolved/iss-2609290405381338-the-release-cut-writes-a-well-formed.md
open on GitHub ↗ · commit history ↗

mentions1

• iss-2609290405451613The release cut accepts a third party's home path, and any other identity finding the scanner grades warn, in public release text. After the hard_fail refusal of iss-2609290405381338, a changelog entries[].text or press_release headline carrying another account's home path (home_path_other) or a GitHub username (github_username) is still written to CHANGELOG.md and RELEASE.md as it stands, because the cut refuses at the bar the launch scan applies to the same files, hard_fail only. Refusing these too is a policy choice, not a mechanical fix: the store-before-commit redactors (history, memory, ideate) redact every identity kind and refuse any that survives, whatever its severity, but github_username fires on the repository owner's name standing as a bare word (a URL and the owner/repo slug are exempt), which a release note may legitimately carry, and the scanner grades that kind review-only, warn, for that reason. Ruling owed to the product thinker: whether public release text is held to the launch bar (hard_fail only, as now), to the store-before-commit bar (every identity kind, accepting refusals of the owner's bare name), or to a middle bar (third-party home paths refused, usernames allowed). Found by the security review of lane drainEcho2 and split from iss-2609290405381338 by lane drainEcho3. Detector, once ruled: a payload carrying a third-party home path in a changelog line is refused or accepted as the ruling says, and the refusal does not carry the path.