improvement(blog): simplify provenance post structure - #6631

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 12, 2026 6:21pm

PR Summary

Low Risk
Documentation-only change to a single MDX blog file; no application or security runtime code affected.

Overview
Rewrites the secret-provenance blog post for a shorter read (~12 → ~7 minutes) and a clearer narrative arc, without changing the underlying technical story.

Front matter updates the description, updated date, reading time, and FAQ answers (fewer, tighter entries; drops entropy/length-floor FAQ items that moved into the body).

Body replaces long sections (architecture overview, activation, four egress categories, entropy tables, tiered matching war stories, verifier/substituter detail, refusal diagnostics) with four focused sections: Follow the Secret, Not Its Shape, Everywhere the Value Can Go, Exact Matching, With One Limit, and Taint Tracking in Reverse. Core ideas (registry activation, projection, fail-closed, eight-character floor, durable provenance, model as egress) remain but with less repetition and fewer tables.

Links fix the OWASP LLM risk URL to the 2025 sensitive-information-disclosure page.

^{Reviewed by Cursor Bugbot for commit ee1bb7a. Configure here.}

Greptile Summary

The PR substantially shortens and restructures the secret-provenance article while retaining its activation, propagation, projection, durable-storage, matching-limit, and information-flow themes.

• Reduces the estimated reading time from twelve to seven minutes.
• Condenses the FAQ and removes several implementation-level sections and examples.
• Reframes the article around the secret lifecycle, egress surfaces, exact matching, and reverse taint tracking.
• Overstates default fail-closed handling for unknown provenance on several durable surfaces.

Confidence Score: 4/5

The PR is safe to merge after a non-blocking documentation correction clarifies which unknown durable-provenance surfaces currently fail closed.

The MDX structure and matching details align with the implementation, but the rewritten durable-storage section overstates default protection for memory, table-row, and knowledge content.

Files Needing Attention: apps/sim/content/blog/secret-provenance/index.mdx

_{Reviews (1): Last reviewed commit: "improvement(blog): simplify provenance p..." | Re-trigger Greptile}