What
Sensitive-path checks now strip editor and backup suffixes and re-test the underlying name, so a swap file or backup copy of a credential is protected the same way the original is.
Details
- Suffixes stripped:
.sw[a-p],.un~,.rej,.save,.tmp,.bak,.orig, plus#file#and.#fileforms. - Matches credential directories
.ssh,.aws,.azure,.gnupg,.kube,.docker; key extensions pem, key, p12, pfx, keystore, jks; ssh key names; andsecrets.yaml/.json/.toml. - Names ending in example, sample, template or dist are excused.
- A group of git and home environment variables is read together, and lookalike characters are folded before matching.
Evidence
GIT_CONFIG_GLOBAL GIT_CONFIG_SYSTEM GIT_CONFIG_NOSYSTEM HOME XDG_CONFIG_HOME HOMEDRIVE HOMEPATH USERPROFILE PROGRAMDATA PATH
Strings lifted out of the shipped bundle, so the claim above can be checked against them.