{
  "id": 15453081,
  "title": "I shipped a redaction library, then found it leaking a private key",
  "url": "https://urgent.news/2026/10/18/i-shipped-a-redaction-library-then-found-it-leaking-a-private-key",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-18T17:19:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/roshcompanylabs/i-shipped-a-redaction-library-then-found-it-leaking-a-private-key-1knm"
  },
  "original_language": "en",
  "account": "A zero-dependency library called llm-stream-guardrails was developed to mask secrets and PII from an LLM's output stream. However, it was discovered that the library had a bug, which allowed for the leaking of a private key. The library held a PEM private key within a PEM block, and the mechanism that held the key trusted the footer. If the footer was mislabeled, the key was read as closed and only the header was masked. The body of the key streamed through in cleartext.\n\nThe tests for the library were designed to assert that a well-formed key block was masked. However, they did not assert the absence of a leak on a malformed block, as the tests were written for inputs that the developers thought of. This allowed for the bug to go unnoticed.\n\nTo fix the bug, the library's tests were changed to stop testing examples and start testing properties adversarially. This meant that for any input, the library would check if a value that the policy should mask ever reached the output. The library was then fuzzed to test roughly 320,000 chunkings, and a leaked body no longer reached the output.\n\nThe four issues that led to the leaking of the private key have been fixed in version 0.7.9 of the library. The regression tests now ensure that the streamed-equals-whole invariant holds across these fuzzed chunkings. A public advisory was also published for the issue: GHSA-777v-7mvx-mxgp. The main lesson from this experience is that a passing test only proves that the code does what you asked, but it says nothing about what you did not. For a redactor or any system whose job is to withhold, a missing test can be the whole product.",
  "summary": "I write a small zero-dependency library, llm-stream-guardrails , that strips secrets and PII out of an LLM's output stream before it reaches a screen or a log. Last week it was leaking a private key. This is the bug, how an adversarial pass found it, and the four things it turned up — now fixed in 0.7.9, with a published advisory (GHSA-777v-7mvx-mxgp). I'm writing it up because the interesting…",
  "key_points": [
    "Library llm-stream-guardrails leaked private key due to bug",
    "Bug allowed cleartext streaming of PEM private key",
    "Fixed in version 0.7.9 with adversarial testing"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}