Exclude competitor references from View Details explanation output - #1535
Exclude competitor references from View Details explanation output#1535cx-tejal-thorat wants to merge 1 commit into
Conversation
The SCA and Containers explanation prompts instructed the model to search the web for "trusted community or vendor reports", then separately told it "Never mention competitor vendors or tools". When search results were dominated by security vendors, the model resolved the conflict in favour of citing them, and Snyk/Orca/Qualys links appeared in the Sources section. Tighten the summary constraint in both prompts to name the excluded category explicitly (appsec vendors) and to state positively which sources are allowed in the Sources section, rather than relying on the model to infer who counts as a Checkmarx competitor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Original alert (resolved)Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-tejal-thorat) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-tejal-thorat) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
|
| Secret Type | Status | Commit | File Path | View |
|---|---|---|---|---|
| Github | a2e4440d0a |
.npmrc |
🔎 View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Immediately rotate/revoke the exposed secret. (https://howtorotate.com/docs/introduction/getting-started/)
- Remove it from git history ( a new "remove secret" commit is NOT enough e.g. with
git-filter-repo).
To avoid such incidents in the future consider:
- Following the best practices for managing and storing secrets, including API keys and other credentials.
- Re-scan after cleanup before merging.
⚠️ These are unverified matches and do not block the merge — please review and confirm they are not real secrets.
2 participants
The SCA and Containers explanation prompts instructed the model to search the web for "trusted community or vendor reports", then separately told it "Never mention competitor vendors or tools". When search results were dominated by security vendors, the model resolved the conflict in favour of citing them, and Snyk/Orca/Qualys links appeared in the Sources section.
Updates the summary constraint in both prompts to say "appsec vendors" outright and to spell out that only open-source advisory sources belong in the Sources section, so the model no longer has to work out for itself who qualifies as a Checkmarx competitor.