Docs
Output sanitisation
Occluded source can escape without anyone opening a file: in a crash, a test report, a coverage file. Every byte from the build's side passes the sanitiser before it reaches the person.
A failure inside an Occluded module
FAIL summarizeInvoice.test.ts
TypeError: Cannot read properties of undefined (reading 'rate')
at <protected module>
at summarizeInvoice (summarizeInvoice.ts:11:18)The contractor sees that the failure is past the boundary, and which of their own lines led there. They do not see the code.
What it does to text
| Control | What it catches |
|---|---|
| Protected frames | Stack frames and lines naming an Occluded path collapse to <protected module>. The frame in the person's own file stays |
| Source matching | Output that reproduces code from an Occluded file, verbatim or reformatted, is redacted |
| Encoded text | Long encoded runs are redacted |
| Secrets | An injected secret's value is replaced by its name |
The full, unsanitised output goes to the record, readable by authorised staff.
Other routes out
| Route | Control |
|---|---|
| Error messages that reveal existence | ENOENT everywhere. Never "permission denied" |
| A debugger stepping into Occluded frames | Debugger traffic is filtered: step-into across the boundary becomes step-over, variables of Occluded frames are withheld, and requests for their source get ENOENT |
| Coverage reports, source maps, bundle output | Filtered before download: files under Occluded paths are removed, and source maps for Occluded modules are never emitted |
| A visible script reads an Occluded file | On the person's side it gets ENOENT. Inside a test on the build's side, its output is sanitised, and code that reads Occluded paths is flagged before it runs |
Downloads
occlude artifact <path> is the only way to take a file out of the build's side. It passes the download filter: files under Occluded paths are removed, there are no source maps for Occluded modules, and a bundle passes only when the profile acknowledges the bundle-reachable warning.
What it cannot catch
Code the build's side runs can read what the build's side can read, so no output filter is complete. Every run is recorded in full, and this residual is set out in writing with every customer. See Security model.