[object Object]

← back to Ios Fleet Recording Qa

recording-qa: add credential lens — flag visible username/API-secret/basic-auth/backend-host in submission clips

a23289a18f03caf72e47e2637dad17767cee5f3c · 2026-09-03 14:13:07 -0700 · Steve Abrams

Found empirically under TK-11155: the real GovArbitrage on-device capture
(1320x2868, 68s) passed the gate TECH_PASS + 'OCR clean' while its Settings
frame showed a plaintext 'Username admin' and the backend host
https://auctions.agentabrams.com. The OCR scan only looked for
email/phone/street-address, so credentials were invisible to it.

Adds a 4th lens over the SAME already-extracted frames (no extra cost):
visible username, api-key/secret/bearer/token, Basic <base64>, and internal
backend hosts. Credential labels sit on their own OCR line above the value
('Username\n\nadmin'), so it matches a newline-flattened copy, skips masked
values (dots/asterisks), and drops label-plus-ordinary-word noise.

WARNS, never hard-fails: Apple's Guideline 2.1 item #4 explicitly asks for
demo credentials, so visible creds must be a conscious choice, not a silent
pass. Verdicts and exit codes are unchanged; count surfaces in the human
output and as cred_hits in --json.

Verified: selftest 6/6 PASS (no regression); real clip now reports 11 hits
across username + backend-host, exit still 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SEhnWQSSkAhSYxWXHJ3MCw

Files touched

Diff

commit a23289a18f03caf72e47e2637dad17767cee5f3c
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 3 14:13:07 2026 -0700

    recording-qa: add credential lens — flag visible username/API-secret/basic-auth/backend-host in submission clips
    
    Found empirically under TK-11155: the real GovArbitrage on-device capture
    (1320x2868, 68s) passed the gate TECH_PASS + 'OCR clean' while its Settings
    frame showed a plaintext 'Username admin' and the backend host
    https://auctions.agentabrams.com. The OCR scan only looked for
    email/phone/street-address, so credentials were invisible to it.
    
    Adds a 4th lens over the SAME already-extracted frames (no extra cost):
    visible username, api-key/secret/bearer/token, Basic <base64>, and internal
    backend hosts. Credential labels sit on their own OCR line above the value
    ('Username\n\nadmin'), so it matches a newline-flattened copy, skips masked
    values (dots/asterisks), and drops label-plus-ordinary-word noise.
    
    WARNS, never hard-fails: Apple's Guideline 2.1 item #4 explicitly asks for
    demo credentials, so visible creds must be a conscious choice, not a silent
    pass. Verdicts and exit codes are unchanged; count surfaces in the human
    output and as cred_hits in --json.
    
    Verified: selftest 6/6 PASS (no regression); real clip now reports 11 hits
    across username + backend-host, exit still 0.
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01SEhnWQSSkAhSYxWXHJ3MCw
---
 recording-qa.sh | 32 ++++++++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/recording-qa.sh b/recording-qa.sh
index 4c3912d..afb1431 100755
--- a/recording-qa.sh
+++ b/recording-qa.sh
@@ -82,13 +82,20 @@ elif [ "$DEVICE_OK" -eq 0 ]; then
 fi
 
 # ---- privacy / PII OCR scan ----------------------------------------------
-PII_HITS=(); FRAMES=0
+PII_HITS=(); CRED_HITS=(); FRAMES=0
 if [ -z "$VERDICT" ] && command -v tesseract >/dev/null 2>&1; then
   TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
   ffmpeg -nostats -loglevel error -i "$VID" -vf "fps=1/${FRAME_EVERY}" "$TMP/f_%04d.png" 2>/dev/null || true
   EMAIL='[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}'
   PHONE='(\+?1[-. ]?)?\(?[0-9]{3}\)?[-. ][0-9]{3}[-. ][0-9]{4}'
   ADDR='[0-9]{1,6} +([A-Z][a-z]+ ){1,3}(St|Street|Ave|Avenue|Rd|Road|Blvd|Dr|Drive|Ln|Lane|Ct|Court|Way|Pl|Place|Blvd)\b'
+  # credential lens (TK-11155): a clip can be PII-clean yet expose a plaintext
+  # username / API key / backend host. Apple's 2.1 item #4 ASKS for demo
+  # credentials, so this WARNS (conscious decision) — it never hard-fails.
+  CRED_USER='(User ?name|Username|Login|User ID)[: ]+[A-Za-z0-9._-]{3,}'
+  CRED_SECRET='(api[ _-]?key|secret|bearer|token|authorization)[: ]+[A-Za-z0-9._-]{8,}'
+  CRED_BASIC='Basic [A-Za-z0-9+/=]{12,}'
+  CRED_HOST='https?://[A-Za-z0-9.-]*(agentabrams\.com|localhost|127\.0\.0\.1)[^ ]*'
   for f in "$TMP"/f_*.png; do
     [ -e "$f" ] || continue
     FRAMES=$((FRAMES+1))
@@ -98,8 +105,24 @@ if [ -z "$VERDICT" ] && command -v tesseract >/dev/null 2>&1; then
       m=$(printf '%s' "$TXT" | grep -oE "$rx" | head -1)
       [ -n "$m" ] && PII_HITS+=("$(basename "$f") $label: $m")
     done
+    # credential labels sit on their OWN OCR line above the value
+    # ("Username\n\nadmin"), so match against a newline-flattened copy.
+    TXTF=$(printf '%s' "$TXT" | tr '\n' ' ' | tr -s ' ')
+    for pat in "$CRED_USER:username" "$CRED_SECRET:api-secret" "$CRED_BASIC:basic-auth" "$CRED_HOST:backend-host"; do
+      rx="${pat%:*}"; label="${pat##*:}"
+      m=$(printf '%s' "$TXTF" | grep -oiE "$rx" | head -1)
+      # drop label-followed-by-ordinary-word noise ("Login with", "Password required")
+      case "$(printf '%s' "$m" | awk '{print tolower($NF)}')" in
+        with|to|or|and|using|required|screen|button|here|below|above|optional|failed|error|settings) m="";; esac
+      # a masked value (dots/asterisks) is fine — only flag a VISIBLE one
+      case "$m" in *"..."*|*"***"*|*"•"*) m="";; esac
+      [ -n "$m" ] && CRED_HITS+=("$(basename "$f") $label: $m")
+    done
   done
   if [ "${#PII_HITS[@]}" -gt 0 ]; then VERDICT="PRIVACY_FLAGGED"; DETAIL="OCR found PII in ${#PII_HITS[@]} frame(s) — redo or crop"; fi
+  CRED_NOTE=""
+  [ "${#CRED_HITS[@]}" -gt 0 ] && CRED_NOTE=" · ${#CRED_HITS[@]} credential/backend string(s) VISIBLE — confirm intentional (Apple 2.1 #4 asks for demo credentials) or crop"
+
 fi
 
 # ---- final verdict --------------------------------------------------------
@@ -112,8 +135,8 @@ if [ -z "$VERDICT" ]; then
 fi
 
 if [ "$JSON" -eq 1 ]; then
-  printf '{"app":"%s","file":"%s","verdict":"%s","duration_s":%s,"dims":"%dx%d","device_meta":"%s","black_frac":%s,"ocr_frames":%d,"pii_hits":%d,"detail":"%s"}\n' \
-    "$APP" "$VID" "$VERDICT" "${DUR:-0}" "${W:-0}" "${H:-0}" "${MODEL:-none}" "$BLACKFRAC" "$FRAMES" "${#PII_HITS[@]}" "$DETAIL"
+  printf '{"app":"%s","file":"%s","verdict":"%s","duration_s":%s,"dims":"%dx%d","device_meta":"%s","black_frac":%s,"ocr_frames":%d,"pii_hits":%d,"cred_hits":%d,"detail":"%s"}\n' \
+    "$APP" "$VID" "$VERDICT" "${DUR:-0}" "${W:-0}" "${H:-0}" "${MODEL:-none}" "$BLACKFRAC" "$FRAMES" "${#PII_HITS[@]}" "${#CRED_HITS[@]}" "$DETAIL${CRED_NOTE:-}"
   case "$VERDICT" in READY_TO_SEND|TECH_PASS_PRIVACY_PENDING) exit 0;; *) exit 1;; esac
 fi
 
@@ -123,9 +146,10 @@ echo "duration   : ${DUR}s   dims: ${W}x${H}   device: ${MODEL:-<none>} ${MAKE:-
 echo "black-frac : $BLACKFRAC   ocr-frames: $FRAMES"
 for n in "${TECH_NOTES[@]:-}"; do [ -n "$n" ] && echo "note       : $n"; done
 for h in "${PII_HITS[@]:-}"; do [ -n "$h" ] && echo "⚠️ PII     : $h"; done
+for h in "${CRED_HITS[@]:-}"; do [ -n "$h" ] && echo "🔑 CRED    : $h"; done
 echo "────────────────────────────────────"
 echo "VERDICT    : $VERDICT"
-echo "             $DETAIL"
+echo "             $DETAIL${CRED_NOTE:-}"
 case "$VERDICT" in
   READY_TO_SEND)             echo "➡️  attach this clip in the ASC Resolution Center reply."; exit 0;;
   TECH_PASS_PRIVACY_PENDING) echo "➡️  eyeball it frame-by-frame; if clean run: recording-qa.sh --approve '$VID'"; exit 0;;

← bab2877 ios-fleet-recording-qa: 2.1 device-recording QA gate (tech +  ·  back to Ios Fleet Recording Qa  ·  selftest: cover the credential lens (it shipped untested) 7f0c634 →