feat: built-in PAM masking - #8196

💬 Discussion in Slack: #pr-review-infisical-8196-feat-built-in-pam-masking

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

Confidence Score: 5/5

Safe to merge; no outstanding blocking issues were identified.

_{Reviews (3) · Last reviewed commit: "misc: addressed greptile"}

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

•   Preserve enabled masking backend/src/ee/services/pam-account-template/pam-account-template-service.ts:238 ▶

  A valid partial settings update replaces the stored settings object at this line. When the template already has built-in detection enabled and the request updates an unrelated settings field without sessionLogMaskingBuiltInDetection, the enabled value is removed. Subsequent reads default the missing value to false, silently disabling session-log masking and potentially exposing sensitive values in later session recordings. Merge supplied settings with the existing settings before saving, while still allowing an explicit false.

  How this was verified: An executed update with a partial settings payload removed the stored enabled value, and the persisted settings parsed as built-in detection disabled.