workspace: memory content mirrored to cloud is unfiltered — no secret/PII redaction
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
- Domain
- cloud, data-engineering, security
Research direction
Trace the memory write and mirror paths in memory-write.ts, memory-extract.ts, and memory-sync.ts, especially push() forwarding block.content to MemoryApi.add/update. Review the consent-related changes in workspace.tsx and link.ts for context. Done requires an agreed content-scanning and redaction design that prevents secrets and PII from leaving the machine when mirroring is enabled.
Written by the indexing model from the issue text.
Description
Found during v0.9.7 release review (Chaos Gremlin/Privacy Auditor persona).
memory-extract.ts's tool description explicitly invites the agent to capture 'warehouse configs found via /discover, query patterns from sql_optimize, naming conventions observed' into memory blocks. Nothing in the write path (memory-write.ts, memory-extract.ts) or the mirror path (memory-sync.ts's push() forwards block.content verbatim to MemoryApi.add/update) does secret-scanning, PII filtering, or redaction before content leaves the machine (when workspace mirroring is enabled).
Compounds the disclosure gap fixed in v0.9.7 (see bind-time consent line added in workspace.tsx/link.ts): once a user knows memory syncs and accepts that, there's still no guardrail preventing a warehouse connection string or customer-identifying value from being captured into a block and mirrored.
Deferred because this needs a content-scanning/redaction design (not a quick patch), and the feature remains gated behind the off-by-default ALTIMATE_WORKSPACE pilot flag.
- Dominant language
- TypeScript
- Stars
- 813
- Forks
- 134
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 67
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from AltimateAI/altimate-code
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
AltimateAI/altimate-code#1359 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
AltimateAI/altimate-code#1323 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
AltimateAI/altimate-code#1288 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
AltimateAI/altimate-code#1285 ·
-
privacy: Altimate Base consent dialog no longer discloses persistent per-installation identifier Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
AltimateAI/altimate-code#1284 ·
All issues in AltimateAI/altimate-code
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
bcgov/bc-wallet-mobile#4761 · 1 comment ·
-
external-issue to-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
refactor
Difficulty 2/5 1-3 hours Newbie friendliness 84/100