GHSA-cf9x-r3xf-wp2p: 
PHP vulnerability analysis and mitigation

Impact

scribe:config-diff prints every config value that differs from the package defaults, so that users can paste the output into a bug report, as the docs recommend. It redacts nothing. auth.use_value, the token Scribe sends on response calls, is printed in full, and so is any credential in strategy settings, such as an Authorization: Bearer … header given to a static-data headers strategy. With the published config, use_value is env('SCRIBE_AUTH_KEY') on both sides of the comparison, so it usually prints nothing. The real token appears when:

• use_value is hard-coded, or read from an env name other than SCRIBE_AUTH_KEY; or
• config is cached (config:cache) and the key lives only in .env. With cached config, .env is not loaded, so the defaults' env() returns null while the cached config holds the token. Anyone who reads a bug report containing that output gets the token.

Root cause

• src/Commands/DiffConfig.php: IGNORE_PATHS leaves out auth.extra_info, but not auth.use_value.
• src/Tools/ConfigDiffer.php prints changed scalars with json_encode(), and lists through VarExporter, without redaction.

Patches

Fixed in 0.2.5. scribe:config-diff reports auth.use_value, and any value under a credential-looking key (such as an Authorization header in a strategy's settings, including inside list entries), as changed but prints it as <redacted>. Rotate any token that already appeared in posted output.

Workarounds

• Keep use_value as env('SCRIBE_AUTH_KEY'), and run the command after config:clear, or with SCRIBE_AUTH_KEY unset.
• Check the output for tokens before you post it anywhere.
• Rotate any token that has already appeared in posted output.