{"record":{"id":"eaf1b1fe63eab923","repo":"zeroclaw-labs/zeroclaw","slug":"static-slack-app-level-token-regex-must-compile","errorCode":null,"errorMessage":"static Slack app-level token regex must compile","messagePattern":"static Slack app-level token regex must compile","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"info","filePath":"crates/zeroclaw-runtime/src/security/leak_detector.rs","lineNumber":207,"sourceCode":"                ),\n                // GitHub\n                (\n                    Regex::new(r\"gh[pousr]_[a-zA-Z0-9]{36,}\").unwrap(),\n                    \"GitHub token\",\n                ),\n                (\n                    Regex::new(r\"github_pat_[a-zA-Z0-9_]{22,}\").unwrap(),\n                    \"GitHub PAT\",\n                ),\n                // Slack\n                (\n                    Regex::new(r\"xox[baprs]-[0-9A-Za-z-]{10,}\")\n                        .expect(\"static Slack token regex must compile\"),\n                    \"Slack token\",\n                ),\n                (\n                    Regex::new(r\"xapp-[0-9A-Za-z-]{10,}\")\n                        .expect(\"static Slack app-level token regex must compile\"),\n                    \"Slack app-level token\",\n                ),\n                (\n                    Regex::new(r\"xwfp-[0-9A-Za-z-]{10,}\")\n                        .expect(\"static Slack workflow token regex must compile\"),\n                    \"Slack workflow token\",\n                ),\n                (\n                    // Rotation family: refresh tokens (`xoxe-…`) and rotated\n                    // access tokens (`xoxe.xoxb-…`, `xoxe.xoxp-…`). The base\n                    // `xox[baprs]-` class excludes `e`, and matching only the\n                    // inner `xoxb-`/`xoxp-` would leave the `xoxe.` prefix\n                    // unredacted, so cover the whole token explicitly.\n                    Regex::new(r\"xoxe(?:-[0-9A-Za-z-]{10,}|\\.xox[bp]-[0-9A-Za-z-]{10,})\")\n                        .expect(\"static Slack rotation token regex must compile\"),\n                    \"Slack refresh/rotated token\",\n                ),\n                // Generic","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/security/leak_detector.rs#L189-L225","documentation":"Sibling of the Slack token pattern: check_api_keys() compiles the hardcoded Slack app-level token pattern xapp-[0-9A-Za-z-]{10,} on each scan and expects compilation to succeed. Regex literals only fail through editing mistakes, so this expect is a programming-error tripwire, not a runtime condition.","triggerScenarios":"Any scan_with_protected_spans() call compiles this pattern; it panics only if the literal in leak_detector.rs was corrupted (bad escape, unbalanced bracket), typically after a hand-merge.","commonSituations":"Contributors adding or adjusting Slack token patterns; cherry-picks that mangle the regex. Released builds have the pattern covered by tests.","solutions":["Test the edited literal in isolation with regex::Regex::new before committing.","Run the leak-detector test suite (scan_with_protected_spans paths) after pattern edits.","Move the pattern set into LazyLock statics so compilation happens once and errors surface at first test run."],"exampleFix":"// before: per-call compile of an edited, now-invalid literal\nRegex::new(r\"xapp-[0-9A-Za-z-{10,}\").expect(\"static Slack app-level token regex must compile\")\n\n// after: fixed literal, compiled once\nstatic SLACK_APP_TOKEN: LazyLock<Regex> =\n    LazyLock::new(|| Regex::new(r\"xapp-[0-9A-Za-z-]{10,}\").expect(\"static Slack app-level token regex must compile\"));","handlingStrategy":"validation","validationCode":"#[test]\nfn slack_app_token_pattern_compiles() {\n    assert!(regex::Regex::new(r\"xapp-[0-9A-Za-z-]{10,}\").is_ok());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add a compilation unit test for every pattern added to check_api_keys.","Compile patterns once via LazyLock/OnceLock instead of on each scan.","Double-check hand-merged backports of leak_detector.rs for mangled regex literals."],"tags":["rust","regex","leak-detection","invariant","static-pattern"],"backgroundTag":"regex-compilation-failed","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}