Please report suspected vulnerabilities privately via GitHub private vulnerability reporting on this repository. Do not open a public issue for anything you believe is a security problem. You should receive an acknowledgement within a few days; please allow a reasonable window for a fix before any public disclosure.
This project probes live APIs with real credentials and commits the resulting transcripts, so its threat surface is specific and worth stating:
- Bearer tokens. Credentials are read from the environment only
(
TFPFGEN_PROBE_TOKEN; the generated pilot provider usesTHOUSANDEYES_BEARER_TOKEN). No command accepts a token flag, and the sandbox profile loader refuses a profile containing a credential-shaped value. Anything that would move a token into a file, a flag, a log line or a committed artefact is a vulnerability — report it. - Committed cassettes. Probe transcripts under
recordings/are public by design. Redaction allowlists rather than denylists, and a recording fails outright (exit7, nothing written) if a credential-shaped value survives. A redaction bypass — any way a secret can reach a committed cassette — is the highest-severity bug this repository can have. - Sandbox profiles.
.tfpfgen/sandbox/is gitignored because a profile carries tenant identifiers. Committed artefacts must never contain tenant names; opaque numeric identifiers are accepted. - Generated fixtures. The fixture derivation refuses to invent values for credential-shaped fields, so generated test configurations cannot contain anything that looks like a secret. Secret-bearing attributes are generated as sensitive or ephemeral and never written to state.
The generated pilot provider (pilot/thousandeyes/) is not published to the
Terraform registry; issues in it are still welcome here, since its code is this
repository's output. Vulnerabilities in the ThousandEyes API or SDK belong with
their respective owners.