Sensitive attribute should (ideally) not be included in source control

[lrasmus]

If a file or folder is annotated as "Sensitive", that we provide some guardrails to warn the user to not add it into source control

Need to balance users who know what they are doing and are intentionally storing something in source control vs. those that may not be aware and/or accidentally include it in source control.

[lrasmus]

For the StatWrap-initiated and managed source control, we would want to consider this attribute for what we would or would not put into source control.

[Hardik301002]

Hi @lrasmus, I'd like to work on this issue. Please assign this to me.

[lrasmus]

Thank you @Hardik301002! Please let me know if you have any questions or want any additional feedback/requirements about what this would look like.

[Hardik301002]

Hi @Irasmus,

Thank you for assigning this issue to me! I have reviewed the requirements and have a plan for implementing the guardrails to prevent sensitive files from being included in source control.

To ensure we balance protection and flexibility, I plan to:

1. Identify Sensitive Files: Use a .sensitive metadata file or predefined patterns.
2. Implement Pre-Commit Hooks: Create a Git hook to warn/block commits of sensitive files with an override option.
3. Provide Automation via Python: A script to scan and warn about sensitive files.
4. Integrate with StatWrap: Ensure that sensitive files are handled correctly when managed by StatWrap.

Let me know if this approach aligns with the project goals or if you have any additional feedback or requirements before I proceed.
Thanks!

[lrasmus]

@Hardik301002 - thank you! I think overall your approaches are all very good. Within the framework of StatWrap, I think there are a few things that we can build on.

StatWrap currently has a "Sensitive Info" attribute that a user can set:

The limitation is that it does require the user to explicitly set this for their file. However, what is "sensitive" in one context may not be sensitive in another. For example, a CSV of healthcare data is sensitive but may not look that way.

If someone has one or more files flagged as sensitive, could you check to see if those files are under source control? We have a basic way to get source control information currently (see https://github.com/StatTag/StatWrap/blob/master/app/services/sourceControl.js), so this would be a matter of building a service that checks the list of files flagged as sensitive against those that are under source control.

[Hardik301002]

@lrasmus I have created a PR to address this issue. Please review: #247

[Ayush4958]

Hi @lrasmus , I would like to work on this

From above conversation , I got the clarification what needs to build

Proposal

• Checks If the file is sensitive file or not.
• Checks If its under source control or not (like git)
• Then will compare the above both point
• If file is sensitive marked and also under source control , then display warning

Things to notice

• It will not restrict them , just a warning
• Files not under source control will not get warning

[lrasmus]

Thank you for your interest in tackling this @Ayush4958 - yes, your proposal sounds like what we are looking for. Please let me know if you have any other questions or want to bounce off ideas as you implement this.

[Ayush4958]

Hi @lrasmus ,

I've created the PR: #327 for this issue.
Please take a look when you have time. Happy to make any changes if needed.