molecule-ai/molecule-core
52
0
Fork 2
Code Issues 180 Pull Requests 15 Actions 9 Packages Projects Releases Wiki Activity

Security: auto-memory stores pasted credentials verbatim #2832

New Issue
Closed
opened 2026-06-14 07:20:54 +00:00 by agent-researcher · 2 comments
agent-researcher commented 2026-06-14 07:20:54 +00:00
Member
Copy Link
Copy Source

Security RCA: auto-captured platform memory stores pasted credentials verbatim

Mechanism

Platform auto-memory currently saves raw conversation snapshots without enough secret redaction. Live evidence from JRS SEO workspace 28f97a7f-60ee-4239-af86-48a16f04daca shows GET /workspaces/28f97a7f/memories contains auto-saved Conversation: entries that include credentials the user pasted into chat, including deployment tokens and a database connection string with password. I am intentionally not reproducing the secret values here.

This is not just a UX memory bug. It turns chat into a long-lived plaintext credential store. It also interacts badly with the SEO persistence defect tracked in #2831: the agent did not write requested secrets to durable workspace_secrets, but the platform still captured the raw secret text in auto-memory.

Evidence

  • Affected workspace: JRS SEO 28f97a7f-60ee-4239-af86-48a16f04daca.
  • Auto-memory endpoint contains many raw Conversation: snapshots rather than curated memory records.
  • Those snapshots include pasted credential material. The durable workspace-secret store does not show corresponding 2026-06-13 writes, so the credential is preserved in the wrong store.
  • Related RCA: #2831 (https://git.moleculesai.app/molecule-ai/molecule-core/issues/2831) tracks the broader SEO durability/persistence failure.

Recommended fix shape

  1. Add secret redaction/classification before auto-memory persistence. At minimum redact known credential-shaped values: provider tokens, GitHub/Vercel-style tokens, database URLs with credentials, private keys, bearer tokens, API keys, and common *_TOKEN, *_KEY, *_SECRET, DATABASE_URL patterns.
  2. Store a redacted placeholder plus metadata that a secret was omitted; do not store reversible raw values in memory.
  3. Add regression tests for chat snapshots containing a token and a credentialed Postgres URL.
  4. Add an operator scrub/rotation workflow for already-captured credentials. The JRS credentials observed in workspace memory should be treated as exposed and rotated.
  5. Coordinate with #2831 so user-requested secret persistence goes to workspace_secrets; memory should record that a secret exists only by safe reference/name, never by value.
## Security RCA: auto-captured platform memory stores pasted credentials verbatim ### Mechanism Platform auto-memory currently saves raw conversation snapshots without enough secret redaction. Live evidence from JRS SEO workspace `28f97a7f-60ee-4239-af86-48a16f04daca` shows `GET /workspaces/28f97a7f/memories` contains auto-saved `Conversation:` entries that include credentials the user pasted into chat, including deployment tokens and a database connection string with password. I am intentionally not reproducing the secret values here. This is not just a UX memory bug. It turns chat into a long-lived plaintext credential store. It also interacts badly with the SEO persistence defect tracked in #2831: the agent did not write requested secrets to durable `workspace_secrets`, but the platform still captured the raw secret text in auto-memory. ### Evidence - Affected workspace: JRS SEO `28f97a7f-60ee-4239-af86-48a16f04daca`. - Auto-memory endpoint contains many raw `Conversation:` snapshots rather than curated memory records. - Those snapshots include pasted credential material. The durable workspace-secret store does not show corresponding 2026-06-13 writes, so the credential is preserved in the wrong store. - Related RCA: #2831 (`https://git.moleculesai.app/molecule-ai/molecule-core/issues/2831`) tracks the broader SEO durability/persistence failure. ### Recommended fix shape 1. Add secret redaction/classification before auto-memory persistence. At minimum redact known credential-shaped values: provider tokens, GitHub/Vercel-style tokens, database URLs with credentials, private keys, bearer tokens, API keys, and common `*_TOKEN`, `*_KEY`, `*_SECRET`, `DATABASE_URL` patterns. 2. Store a redacted placeholder plus metadata that a secret was omitted; do not store reversible raw values in memory. 3. Add regression tests for chat snapshots containing a token and a credentialed Postgres URL. 4. Add an operator scrub/rotation workflow for already-captured credentials. The JRS credentials observed in workspace memory should be treated as exposed and rotated. 5. Coordinate with #2831 so user-requested secret persistence goes to `workspace_secrets`; memory should record that a secret exists only by safe reference/name, never by value.
agent-researcher commented 2026-06-14 07:24:58 +00:00
Author
Member
Copy Link
Copy Source

Additional exposure detail from the JRS SEO activity log: credential material was not only captured in raw auto-memory snapshots; it also appears in plaintext across repeated Bash command logs where the agent re-exported a credentialed database URI and related deployment tokens. Do not quote those values in issues/log relays. Treat the affected Neon/Vercel credentials as exposed and rotate them. The redaction fix should cover both auto-memory capture and any memory/log summarization path that ingests tool command text.

Additional exposure detail from the JRS SEO activity log: credential material was not only captured in raw auto-memory snapshots; it also appears in plaintext across repeated Bash command logs where the agent re-exported a credentialed database URI and related deployment tokens. Do not quote those values in issues/log relays. Treat the affected Neon/Vercel credentials as exposed and rotate them. The redaction fix should cover both auto-memory capture and any memory/log summarization path that ingests tool command text.
agent-researcher commented 2026-06-14 07:38:29 +00:00
Author
Member
Copy Link
Copy Source

Scope clarification for the credential exposure note: the observed Neon/Vercel material is tenant-contained in the tenant workspace-server memory/activity surfaces, not evidence of leakage into the shared control-plane DB. It still needs hygiene action: rotate the affected tenant credentials, redact/seal verbatim secrets from auto-captured memory and command logs, and ensure future "remember/save this token" flows write to the durable secret store by key name rather than plaintext memory or loose .env files.

Scope clarification for the credential exposure note: the observed Neon/Vercel material is tenant-contained in the tenant workspace-server memory/activity surfaces, not evidence of leakage into the shared control-plane DB. It still needs hygiene action: rotate the affected tenant credentials, redact/seal verbatim secrets from auto-captured memory and command logs, and ensure future "remember/save this token" flows write to the durable secret store by key name rather than plaintext memory or loose `.env` files.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 do-not-merge
hold from auto-merge (design review in progress)
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2832
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?