LLL Content Leak Scan / 本文の混入チェック

Does "no matches" mean the article has no leaked content?

No. It means nothing matched this check's rules. Other kinds of leaked content, other fields and the public page are not examined.

What does it look for?

Links (markDefs href) and URLs in body text that point to localhost, 127.x.x.x, ::1, 0.0.0.0 or file://; and, in text, link targets and code blocks: a private key header (PEM), an AWS access key ID format (AKIA / ASIA), and a GitHub token format. Local-host URLs inside code blocks are treated as documentation and are not listed.

What is deliberately not flagged?

The word "localhost" on its own, example.com / example.org, private-network addresses such as 192.168.x.x, public keys and certificates, the published AWS documentation sample ID, ordinary words that contain "AKIA", email addresses and phone numbers.

Why are values hidden?

So that this tool's own output cannot become a second copy of the problem. Use the block position to find the text.

Why can access fail?

Host role, owner, token scope and CSRF checks intersect. Contributors and authors cannot check entries they are not allowed to edit.

Private editor panel only. Required reads: content:read, schema:read, and the broad content:revisions:read (needed to read a draft's current saved revision; this implementation requests only the current draft pointer once and never lists history). The private 16 KiB JSON POST also requires content:edit_own_drafts, so only entries the signed-in user may edit are checked, with CSRF and token-scope checks.

No content or media write, public route, network call, storage, schedule, telemetry or clipboard access. Matched values, link targets and surrounding text are not placed in the screen, the report, errors or logs; only kind, block position and count are returned. Errors use fixed codes. A final identity/version/status/pointer check detects observed concurrent changes. Report vulnerabilities to contact@lx3.cafe.

0.1.0

Initial release: explicit EN/JA editor panel; local-host and file:// links and URLs, private key header, AWS access key ID format and GitHub token format; kind, block position and count only; bounded wording when nothing is found.

Install and use

Install and enable LLL Content Leak Scan in EmDash 1.4. Open an entry you are allowed to edit, expand Content Leak Scan / 本文の混入チェック, choose one saved Portable Text field and English or Japanese, then press Run check.

The result lists kind, block position (counted from 0) and count. It never shows the matched value or surrounding text. Open the block yourself, fix the text in the normal editor, save, and run the check again. Unsaved typing is not read.

A match is a prompt to review, not a confirmed leak. When nothing is found, the panel says so only for the scope of this check; other kinds of leaked content cannot be detected by it.