Back to review · Raw Markdown · Review pack (HTML)

InfraFabric External Review Pack — Single File

This is a single-file bundle intended for review environments that cannot reliably fetch multiple URLs.

Links

Alternate host mirror (same paths)

Review instructions (portable)

Hard rules:

  1. 100% factual: every non-trivial claim must be tagged [SOURCE]/[REVIEW]/[TRACE]/[INFERENCE]. If unverified, say “unverified” and stop.
  2. Vendor-neutral: critique deployment conditions + org behaviors, not vendor intent/competence.
  3. Mirror discipline: follow the review document’s section order; do not invent a new structure.

Deliverables: A) 5–10 bullets: what works / what doesn’t (tag each) B) Scorecard (0–5): mirror integrity, layout fidelity, humor discipline, mermaid value, if.trace demo value, CTA stealth C) Section-by-section critique (mirror headings): what’s mirrored, what’s missing, what feels templated/repeated D) Vendor-safe conclusion rewrite: success conditions / traps / questions-to-ask-vendor E) Unified diff patches against the current Dave bible (e.g., IF_DAVE_BIBLE_v2.0.md) and generator rules

if.trace receipt (portable extract)

{
  "id": "3ceff3f9-c85a-4afe-8e2f-2ce76c7b8a75",
  "status": "done",
  "createdAt": "2026-01-06T03:48:36Z",
  "originalFilename": "if-security-secrets-detect-demo.md",
  "style": "if.security.secrets.detect.v0.1",
  "sourceSha256": "6a0ea78388a98a09c26265cacd92ff6032e765cb323268c87d4d36e0ad20dcac",
  "outputSha256": "42c731df103c9662ed212dff86d8a07a49e98e070277139ef51d20d7b751c8e0",
  "warnings": ""
}

Review document (Markdown)

# if.security.secrets.detect — demo findings (synthetic repo)

Black/white:
- Verified: this output is bound to the input fingerprint on the trace page (hashes).
- Not verified: completeness of detection; validity of any token; impact; compliance claims.

## Inputs (factual)
- Product ID: `if.security.secrets.detect`
- Ruleset: `builtin.v0.1` (sha256: `3d0745f949e494c0b62823f8c38a03bc8eb1eb33ea08f2b2d9559525c0e62e25`)
- Source bundle: `source.tgz`
- Source sha256: `6a0ea78388a98a09c26265cacd92ff6032e765cb323268c87d4d36e0ad20dcac`

## Receipt links (public; no login)
https://infrafabric.io/static/trace/n6DSejaslZrB2ciVjLiBCg
https://infrafabric.io/static/pack/n6DSejaslZrB2ciVjLiBCg

## Summary (factual)
- Files scanned: `4`
- Findings: `5`
- Findings by rule:
  - `aws_access_key_id`: `1`
  - `github_token`: `1`
  - `jwt`: `1`
  - `openai_api_key`: `1`
  - `slack_token`: `1`

## Findings (redacted)

- `jwt` — `jwt.txt:1` — `eyJa…cccc` — `match_sha256=754e2608efb1…`
  - Context (redacted): `jwt = <REDACTED:jwt:754e2608>`
- `aws_access_key_id` — `aws.txt:1` — `AKIA…CDE1` — `match_sha256=ddcce2d6b9a6…`
  - Context (redacted): `aws_access_key_id = <REDACTED:aws_access_key_id:ddcce2d6>`
- `github_token` — `README.md:8` — `ghp_…wxyz` — `match_sha256=6675cd0c365d…`
  - Context (redacted): `<REDACTED:github_token:6675cd0c>`
- `openai_api_key` — `.env:2` — `sk-T…CDEF` — `match_sha256=8f807246636e…`
  - Context (redacted): `OPENAI_API_KEY=<REDACTED:openai_api_key:8f807246>`
- `slack_token` — `.env:3` — `xoxb…GHIJ` — `match_sha256=e6d535cf78ec…`
  - Context (redacted): `SLACK_TOKEN=<REDACTED:slack_token:e6d535cf>`

## Safety note (black/white)
- This demo uses **synthetic** secrets only. Do not run against real repositories without a safe-handling policy.
- Do not publish raw secret values in outputs, logs, receipts, or review packs.

## Raw findings (JSON; redacted)

```json
{
  "created_at": "2026-01-06T03:48:36Z",
  "findings": [
    {
      "context_redacted": "jwt = <REDACTED:jwt:754e2608>",
      "line": 1,
      "match_preview": "eyJa\u2026cccc",
      "match_sha256": "754e2608efb170838febcbe48f5a99218223f1d5fbdabf67342ffd11bd6b2c62",
      "path": "jwt.txt",
      "rule_id": "jwt"
    },
    {
      "context_redacted": "aws_access_key_id = <REDACTED:aws_access_key_id:ddcce2d6>",
      "line": 1,
      "match_preview": "AKIA\u2026CDE1",
      "match_sha256": "ddcce2d6b9a68297d36574c90f77293d9bcadeeba6140a6c988a204b07012095",
      "path": "aws.txt",
      "rule_id": "aws_access_key_id"
    },
    {
      "context_redacted": "<REDACTED:github_token:6675cd0c>",
      "line": 8,
      "match_preview": "ghp_\u2026wxyz",
      "match_sha256": "6675cd0c365d2c7d9027a150ec24850631369632248b4b346210ebdf1a59d6b7",
      "path": "README.md",
      "rule_id": "github_token"
    },
    {
      "context_redacted": "OPENAI_API_KEY=<REDACTED:openai_api_key:8f807246>",
      "line": 2,
      "match_preview": "sk-T\u2026CDEF",
      "match_sha256": "8f807246636ed48aae47f229a132c6c795900c6e62695217b73d5be9eb78fb0b",
      "path": ".env",
      "rule_id": "openai_api_key"
    },
    {
      "context_redacted": "SLACK_TOKEN=<REDACTED:slack_token:e6d535cf>",
      "line": 3,
      "match_preview": "xoxb\u2026GHIJ",
      "match_sha256": "e6d535cf78ec149fe8e6ad21bca9770fb94bd858335be4c78f7c126a60438d71",
      "path": ".env",
      "rule_id": "slack_token"
    }
  ],
  "input": {
    "kind": "file",
    "path": "/root/tmp/if_security_secrets_detect_demo/build/source.tgz",
    "sha256": "6a0ea78388a98a09c26265cacd92ff6032e765cb323268c87d4d36e0ad20dcac"
  },
  "product_id": "if.security.secrets.detect",
  "ruleset": {
    "hash_sha256": "3d0745f949e494c0b62823f8c38a03bc8eb1eb33ea08f2b2d9559525c0e62e25",
    "id": "builtin.v0.1",
    "rule_ids": [
      "aws_access_key_id",
      "github_token",
      "openai_api_key",
      "slack_token",
      "private_key_pem",
      "jwt"
    ]
  },
  "summary": {
    "by_rule": {
      "aws_access_key_id": 1,
      "github_token": 1,
      "jwt": 1,
      "openai_api_key": 1,
      "slack_token": 1
    },
    "files_scanned": 4,
    "findings_total": 5
  }
}