Location: src/util.ts:226 (OP_COMMAND['secrets.set']), rendered by nextActionsLines/renderNextActions from many commands.
Kind: secret in terminal output / shell-history advice.
Impact: nextActions arrives in API bodies. If the platform ever populates args.value for a secrets.set hint, the value is printed to stdout verbatim and the user is told to paste it on a command line, landing it in shell history. redactSensitive (src/redact.ts) is wired only to insta feedback and is not applied here.
Evidence:
'secrets.set': (a) => `insta secrets set ${a.name ?? '<NAME>'} ${a.value ?? '<value>'}`,Fix would touch: this one map entry: render the placeholder <value> unconditionally, or pass the rendered line through redactSensitive.
Found by Yun Tianming: nightly sweep 2026-09-17-1000 at ecfe5168a32e. Report only; no code was changed for this finding.
🤖 Generated with Claude Code
Location:
src/util.ts:226(OP_COMMAND['secrets.set']), rendered bynextActionsLines/renderNextActionsfrom many commands.Kind: secret in terminal output / shell-history advice.
Impact:
nextActionsarrives in API bodies. If the platform ever populatesargs.valuefor asecrets.sethint, the value is printed to stdout verbatim and the user is told to paste it on a command line, landing it in shell history.redactSensitive(src/redact.ts) is wired only toinsta feedbackand is not applied here.Evidence:
Fix would touch: this one map entry: render the placeholder
<value>unconditionally, or pass the rendered line throughredactSensitive.Found by Yun Tianming: nightly sweep
2026-09-17-1000atecfe5168a32e. Report only; no code was changed for this finding.🤖 Generated with Claude Code