🛡️ Sentinel: [HIGH] Fix 누락된 Slack/Webhook 시크릿 마스킹 토큰 추가

[seonghobae]

🚨 Severity: HIGH
💡 Vulnerability: scanner/rules/secrets.yml에 추가된 hardcoded-slack-webhook-url 시크릿 룰에 해당하는 토큰(slack, webhook)이 scanner/cli/appguardrail.py의 _SENSITIVE_RULE_TOKENS에 누락되어 있었습니다. 이로 인해 CLI 스캐너 결과 출력이나 CI/CD 로그에 실제 Slack Webhook URL이 마스킹 없이 평문으로 노출될 위험이 존재했습니다.
🎯 Impact: 공격자나 인가되지 않은 인원이 CI 로그나 터미널 출력에 노출된 Slack Webhook URL을 탈취하여 해당 워크스페이스에 악의적인 메시지나 피싱 링크를 주입할 수 있습니다.
🔧 Fix: _SENSITIVE_RULE_TOKENS 튜플에 "slack"과 "webhook"을 추가하여 해당 룰에 매칭되는 시크릿 스니펫이 터미널 환경에서 [REDACTED: sensitive match suppressed]로 안전하게 마스킹되도록 수정했습니다. 또한 test_is_sensitive_rule_slack_webhook 테스트 코드를 추가하여 검증을 강화했습니다.
✅ Verification: python -m pytest tests/ 명령어로 추가된 테스트 케이스와 전체 테스트 슈트가 100% 정상 통과함을 확인했습니다.

---

PR created automatically by Jules for task 16474462683798965785 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR hardens AppGuardrail’s CLI output redaction so findings for the new hardcoded-slack-webhook-url secret rule won’t leak real Slack webhook URLs into terminal output or CI logs.

Changes:

• Add "slack" and "webhook" to scanner/cli/appguardrail.py’s _SENSITIVE_RULE_TOKENS so matching findings have their snippets suppressed.
• Add a unit test asserting Slack rule IDs are treated as sensitive.
• Document the incident/learning in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
scanner/cli/appguardrail.py	Expands sensitive rule token list to ensure Slack webhook findings are snippet-redacted.
tests/test_appguardrail.py	Adds a regression test for _is_sensitive_rule() covering Slack webhook/token rule IDs.
.jules/sentinel.md	Records the missing-redaction-token issue and the preventative practice going forward.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

[seonghobae]

Closing as no-path: merge conflicts with develop (DIRTY/CONFLICTING). Duplicate bot work already covered by newer open PRs (e.g. SSRF via #426 auto-merge, palette/bolt successors). Reopen only from a rebased branch with unique delta.

[google-labs-jules]

Closing as no-path: merge conflicts with develop (DIRTY/CONFLICTING). Duplicate bot work already covered by newer open PRs (e.g. SSRF via #426 auto-merge, palette/bolt successors). Reopen only from a rebased branch with unique delta.

Understood. Acknowledging that this work is obsolete due to merge conflicts and duplicate efforts. Stopping work on this task.