Finding / agent-flywheel
2026-10-13-agent-flywheel-shareable-task-packets-retained-raw-data-beside-sanitized-briefs
Shareable task packets retained raw data beside sanitized briefs. A sanitized task brief coexisted with a duplicate raw Bead object in packet JSON, so credentials in task fields could still reach packet recipients. The October 10 patch removes that duplication, sanitizes titles and labels and extends service-key/webhook masking in packet and support artifacts. The fix remains untagged. This establishes conditional exposure through the export path, not that any particular secret leaked.
Channel: main-unreleased. Half: defect. Date: 2026-10-10.
Operator consequence: Inspect every field of retained packet JSON and support artifacts before sharing them, including raw source, titles and labels. Sanitized Markdown alone is insufficient evidence that the exported object is safe.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-agent-flywheel-shareable-task-packets-retained-raw-data-beside-sanitized-briefs
Profile citations
- Agent Flywheel / claim / shareable-packet-raw-fields
- Agent Flywheel / posture / governance
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-agent-flywheel-shareable-task-packets-retained-raw-data-beside-sanitized-briefsgithub.com/Dicklesworthstone/agentic_coding_flywheel_setup/commit/ae06b55cab0f0862776e5cbbe30b3a6e6f75dc97tagged commit file2026-10-13-agent-flywheel-shareable-task-packets-retained-raw-data-beside-sanitized-briefsDicklesworthstone/agentic_coding_flywheel_setup / scripts/lib/swarm_packet.sh#L615-L650