{"record":{"id":"00f2b31743dd7cb0","repo":"zeroclaw-labs/zeroclaw","slug":"static-slack-rotation-token-regex-must-compile","errorCode":null,"errorMessage":"static Slack rotation token regex must compile","messagePattern":"static Slack rotation token regex must compile","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/zeroclaw-runtime/src/security/leak_detector.rs","lineNumber":222,"sourceCode":"                ),\n                (\n                    Regex::new(r\"xapp-[0-9A-Za-z-]{10,}\")\n                        .expect(\"static Slack app-level token regex must compile\"),\n                    \"Slack app-level token\",\n                ),\n                (\n                    Regex::new(r\"xwfp-[0-9A-Za-z-]{10,}\")\n                        .expect(\"static Slack workflow token regex must compile\"),\n                    \"Slack workflow token\",\n                ),\n                (\n                    // Rotation family: refresh tokens (`xoxe-…`) and rotated\n                    // access tokens (`xoxe.xoxb-…`, `xoxe.xoxp-…`). The base\n                    // `xox[baprs]-` class excludes `e`, and matching only the\n                    // inner `xoxb-`/`xoxp-` would leave the `xoxe.` prefix\n                    // unredacted, so cover the whole token explicitly.\n                    Regex::new(r\"xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp]-[0-9A-Za-z-]{10,})\")\n                        .expect(\"static Slack rotation token regex must compile\"),\n                    \"Slack refresh/rotated token\",\n                ),\n                // Generic\n                (\n                    Regex::new(r#\"api[_-]?key[=:]\\s*['\"]*[a-zA-Z0-9_-]{20,}\"#).unwrap(),\n                    \"Generic API key\",\n                ),\n            ]\n        });\n\n        for (regex, name) in regexes {\n            collect_regex_redactions(\n                content,\n                regex,\n                protected_spans,\n                name,\n                \"[REDACTED_API_KEY]\",\n                patterns,","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/security/leak_detector.rs#L204-L240","documentation":"Same compile-time invariant as the other leak-detector patterns: check_api_keys hard-compiles the Slack rotation-family regex covering refresh tokens (`xoxe-...`) and rotated access tokens (`xoxe.xoxb-...`, `xoxe.xoxp-...`). The .expect() can only fire when the pattern literal itself is invalid, because the string is a constant with no runtime input.","triggerScenarios":"The rotation-family pattern `xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp]-[0-9A-Za-z-]{10,})` is edited into an invalid regex (for example a broken group or missing brace) and any leak scan runs, constructing the pattern table and panicking.","commonSituations":"Extending the detector to new `xoxe` token shapes; merging divergent edits to the pattern table; syntax slips in the alternation group during copy-paste.","solutions":["Restore the pattern to a valid form, e.g. `xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp]-[0-9A-Za-z-]{10,})`, then run `cargo test -p zeroclaw-runtime`","Compile the edited pattern standalone with `regex::Regex::new` in a scratch test to locate the syntax error","Add a unit test that compiles every pattern in the table so regressions fail in CI instead of at scan time"],"exampleFix":"// before\nRegex::new(r\"xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp-[0-9A-Za-z-]{10,})\") // group broken\n    .expect(\"static Slack rotation token regex must compile\"),\n\n// after\nRegex::new(r\"xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp]-[0-9A-Za-z-]{10,})\")\n    .expect(\"static Slack rotation token regex must compile\"),","handlingStrategy":"validation","validationCode":"#[test]\nfn rotation_pattern_compiles() {\n    regex::Regex::new(r\"xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp]-[0-9A-Za-z-]{10,})\")\n        .expect(\"static Slack rotation token regex must compile\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Cover every detector pattern with a compile test so syntax edits are caught at build time","Run `cargo test -p zeroclaw-runtime` before committing changes to the security module"],"tags":["rust","regex","panic","leak-detector","slack","token-rotation"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}