fix: post-scan guidance led with the wrong step - #31
Merged
Conversation
A user scanned 100 repositories and found roughly fifteen infected in the
first twenty. What snare told them next was:
Next: snare fix <owner/repo> (dry run)
snare notify <owner/repo> (tell collaborators)
That is the wrong order and it omits the urgent part.
Credentials are this family's objective, not a side effect, so rotation comes
first — removing a payload does not un-steal a token, and an npm token with
write access is how one machine becomes a supply-chain event.
Cleaning repositories first is also wasted work when the machine that pushed
to them is still infected: this family injects into commits on the way out, so
it re-injects into whatever you just cleaned. When three or more repositories
are flagged the output now says so directly, because at that point the common
factor is the machine, not fifteen separate accidents.
New order: rotate, check this machine, then fix, then notify.
snare still does not fix anything on its own, and should not — fix can
force-push and rewrite history, so it stays explicit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A user scanned 100 repos and found ~15 infected in the first 20. snare told them:
Wrong order, and it omits the urgent part.
New order: rotate → check this machine → fix → notify.
snare still doesn't fix anything on its own, and shouldn't:
fixcan force-push and rewrite history, so it stays explicit.