{"version":"2.1.248","anchor":"backups-of-secret-files-are-now-treated-as-secrets","canonical_anchor":"backups-of-secret-files-are-now-treated-as-secrets","heading":"Backups of secret files are now treated as secrets","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/backups-of-secret-files-are-now-treated-as-secrets","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Backups of secret files are now treated as secrets\n\nEditor swap and backup copies of credential files are now protected like the originals.\n\n**What**\n\nSensitive-path checks now strip editor and backup suffixes and re-test the underlying name, so a swap file or backup copy of a credential is protected the same way the original is.\n\n**Details**\n\n- Suffixes stripped: `.sw[a-p]`, `.un~`, `.rej`, `.save`, `.tmp`, `.bak`, `.orig`, plus `#file#` and `.#file` forms.\n- Matches credential directories `.ssh`, `.aws`, `.azure`, `.gnupg`, `.kube`, `.docker`; key extensions pem, key, p12, pfx, keystore, jks; ssh key names; and `secrets.yaml`\/`.json`\/`.toml`.\n- Names ending in example, sample, template or dist are excused.\n- A group of git and home environment variables is read together, and lookalike characters are folded before matching.\n\n**Evidence**\n\n`GIT_CONFIG_GLOBAL GIT_CONFIG_SYSTEM GIT_CONFIG_NOSYSTEM HOME XDG_CONFIG_HOME HOMEDRIVE HOMEPATH USERPROFILE PROGRAMDATA PATH`\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}