False positive on DNS TXT records

[MaxymVlasov]

It says that f9ac518a0cbf2389741306e36b48a8cb is secret, when it's just verification string for DNS TXT record

          - name: _twilio.example.com
            type: TXT
            records:
              - twilio-domain-verification=f9ac518a0cbf2389741306e36b48a8cb

[AshwinMohan86]

When was this alert triggered for you, and on which repository? That would help us troubleshoot. Thanks!

[AshwinMohan86]

Got it.. based on our analysis of what you provided here already, the fix we shipped last week will ensure these dont get surfaced again.

[MaxymVlasov]

Well, probably there is some issue or with fix delivery or fix not cover this case

[AshwinMohan86]

unfortunately without looking at the actual content in the alert above, we cant make an inference to what you are referring to here.

[MaxymVlasov]

So what the way to share wrong alert with you without exposing private info? I don't see any "report alert" button inside alert window, only Give feedback which points to this public accessible discussion

Btw, discussion which start from this issue resulted in next infosec decision

Also, there are a few extra common things which annoys developers:

Our common ones are:
* random IDs generated for tests and docs
* passwords used in tests
* the url for our private pypi https://pip.example.com/1cdfs3af71ba4d77a70ba4x2bb5f28ba/

Also, it's triggering on SHA in lock files, IE, for .terraform.lock.hcl it yelling both h1: and zh:

Glad it will help

[AshwinMohan86]

thanks for the details, these are helpful