Issues

• chore(changelog): every parallel PR conflicts on CHANGELOG.md; move [Unreleased] entries to per-PR fragments under changelog.d/

  enhancementP1
  awslabs/ferret-scan#821 · Filter by author sectoramen opened on Oct 28, 2026 · v2.6.0

• cli: the --pre-commit-mode not-examined notice says contents unreadable for every cause, including a budget cut-short and a parse failure

  buggoP2
  awslabs/ferret-scan#817 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• scripts: pr-checklist.sh captures to fixed /tmp paths, so concurrent runs overwrite each other's output and misattribute failures

  bugP2
  awslabs/ferret-scan#816 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0
  2

  

• secrets: session is a pattern keyword but not a line-gate admit word, so session=<8-11 bytes> on a line under 20 bytes is never scanned

  buggoP2
  awslabs/ferret-scan#815 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• ci: the ipaddress real-files test walks the runner's /usr/share for 377-600 s and times out the Ubuntu Go job (3 timeouts on 2026-10-22)

  bugP1
  awslabs/ferret-scan#810 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• secrets: a hex password in URI user info is capped at 55 LOW by the unlabelled-hex ceiling, so the pre-commit gate exits 0 on REDIS_URL

  buggoP1
  awslabs/ferret-scan#808 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• secrets: a masked token that keeps its provider prefix (gho_ + asterisks) escapes the already-masked veto and reports at 72-100

  buggoP1
  awslabs/ferret-scan#807 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• medicalid: a Unix epoch timestamp that passes the NPI check is reported as an NPI at 90 when NPI is on the line

  buggoP1
  awslabs/ferret-scan#806 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• bankaccount: a 12-digit cloud account id next to the word account is reported as US_BANK_ACCOUNT, HIGH in a financial-domain .docx

  buggoP1
  awslabs/ferret-scan#805 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• ssn: the 9-digit tail of a URL slug is reported as an SSN, HIGH inside a .docx table

  buggoP1
  awslabs/ferret-scan#804 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• vin: a URL permalink of p + 16 digits is reported as a VIN at 90 when its check digit happens to match

  buggoP1
  awslabs/ferret-scan#803 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• creditcard: a bare 16-digit Luhn-valid counter reaches HIGH 95 with no card keyword on the line

  buggoP1
  awslabs/ferret-scan#802 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• bankaccount: an all-caps English word whose letters 5-6 spell a country code is reported as SWIFT_BIC 100 on any line with a banking word

  buggoP1
  awslabs/ferret-scan#801 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• otp: a lowercase English word of 16+ letters is reported as OTP_SECRET, HIGH when an MFA word shares the line

  buggoP1
  awslabs/ferret-scan#800 · Filter by author sectoramen opened on Oct 24, 2026 · v2.6.0

• otp: RECOVERY_CODES reports kebab-case shell flags and paths (--only-show-errors, data-bucket) whenever 'backup' appears on the line

  awslabs/ferret-scan#798 · Filter by author rustic opened on Oct 22, 2026
  1

• context: the Configuration ratio counts a trailing newline and comment lines, so a file's docType (+15 on every secrets candidate) depends on its layout

  buggoP1
  awslabs/ferret-scan#788 · Filter by author sectoramen opened on Oct 16, 2026 · v2.6.0

• secrets: a Title-case English word after session:/password: in prose is reported as a credential, at HIGH when the document has a table at the top

  buggoP1
  awslabs/ferret-scan#787 · Filter by author sectoramen opened on Oct 16, 2026 · v2.6.0

• Audit tracking: 51 measured detection/redaction items (2026-10)

  documentation
  awslabs/ferret-scan#774 · Filter by author sectoramen opened on Oct 14, 2026
  

• secrets: dashed key spellings (x-api-key, X-Api-Key headers, api-key, secret-key, access-key, private-key) are never detected

  bug
  awslabs/ferret-scan#764 · Filter by author sectoramen opened on Oct 13, 2026

• metadata: a provenance value reaches 100 HIGH when the product name contains a validator keyword (7 validators)

  awslabs/ferret-scan#692 · Filter by author sectoramen opened on Sep 15, 2026
  

• cross-validator deconfliction: 5.15% of findings are sub-spans of a wider, more-confident finding, and only redaction knows it

  awslabs/ferret-scan#687 · Filter by author sectoramen opened on Sep 15, 2026
  

• validators: every finding's metadata map sits exactly at a Go bucket cliff — the next key added costs ~342 B per finding

  awslabs/ferret-scan#621 · Filter by author sectoramen opened on Sep 9, 2026
  3

  

• Trust-boundary decision for a config discovered inside the scan target: opt-in gating, a THREAT_MODEL entry, and the pre-commit gate that silences the provenance disclosure

  awslabs/ferret-scan#293 · Filter by author sectoramen opened on Aug 12, 2026
  4