The AI-written credential validation used a strict parser that detected only tightly formatted $secrets references, while the runtime expression engine accepted whitespace/newline variants. Stored references that slipped past validation later resolved to protected secrets, letting users without externalSecret:list access secret values.

+import {+	extractProviderKeysFromExpression,+	getExternalSecretExpressionPaths,+} from './external-secrets.utils';+ import { BadRequestError } from '@/errors/response-errors/bad-request.error'; import type { SecretsProviderAccessCheckService } from '@/modules/external-secrets.ee/secret-provider-access-check.service.ee'; import { userHasScopes } from '@/permissions.ee/check-access';-import { getAllKeyPaths } from '@/utils';  // #region External Secrets -/**- * Regular expression pattern for valid provider keys.- * Keep this in sync with the regex implemented in CreateSecretsProviderConnectionDto.- */-const PROVIDER_KEY_PATTERN = '[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*';--/**

-	}-	return value.includes('$secrets.') || value.includes('$secrets[');-}--/**- * Extracts the provider keys from an expression string.- * Supports both dot notation ($secrets.vault.key) and bracket notation ($secrets['vault']['key']).- * Only extracts provider keys from $secrets references inside {{ }} expression braces.- *- * @param expression - The expression string containing $secrets reference- * @returns Array of unique provider keys, or empty array if none found- *- * @example- * extractProviderKeys("={{ $secrets.vault.myKey }}") // returns ["vault"]- * extractProviderKeys("={{ $secrets['aws']['secret'] }}") // returns ["aws"]- * extractProviderKeys("={{ $secrets.vault.myKey + ':' + $secrets.aws.otherKey }}") // returns ["vault", "aws"]- * extractProviderKeys("$secrets.vault.key") // returns [] (not inside braces)- */-export function extractProviderKeys(expression: string): string[] {-	const providerKeys = new Set<string>();--	const expressionBlocks = expression.matchAll(/\{\{(.*?)\}\}/gs);--	for (const expression of expressionBlocks) {-		const expressionContent = expression[1]; // Content inside {{ }}--		// Match all dot notation occurrences: $secrets.providerKey-		const dotMatches = expressionContent.matchAll(-			new RegExp(`\\$secrets\\.(${PROVIDER_KEY_PATTERN})`, 'g'),-		);-		for (const match of dotMatches) {-			providerKeys.add(match[1]);-		}--		// Match all bracket notation occurrences: $secrets['providerKey'] or $secrets["providerKey"]-		const bracketMatches = expressionContent.matchAll(-			new RegExp(`\\$secrets\\[['"](${PROVIDER_KEY_PATTERN})['"]\\]`, 'g'),-		);-		for (const match of bracketMatches) {-			providerKeys.add(match[1]);-		}-	}--	return Array.from(providerKeys);-}- /**

  /**@@ -85,7 +28,7 @@ export function isChangingExternalSecretExpression( 	existingData: ICredentialDataDecryptedObject, ): boolean { 	// Find all paths in newData that contain external secret expressions

+import { getAllKeyPaths } from '@/utils';++/**+ * Regular expression pattern for valid provider keys.+ * Keep this in sync with the regex implemented in CreateSecretsProviderConnectionDto.+ */+const PROVIDER_KEY_PATTERN = '[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*';++/**

+	}+	return value.includes('$secrets.') || value.includes('$secrets[');

+ * Extracts the provider keys from an expression string.+ * Supports both dot notation ($secrets.vault.key) and bracket notation ($secrets['vault']['key']).+ * Only extracts provider keys from $secrets references inside {{ }} expression braces.+ */+export function extractProviderKeysFromExpression(expression: string): string[] {+	const providerKeys = new Set<string>();++	const expressionBlocks = expression.matchAll(/\{\{(.*?)\}\}/gs);++	for (const expression of expressionBlocks) {+		const expressionContent = expression[1]; // Content inside {{ }}++		// Match all dot notation occurrences: $secrets.providerKey+		const dotMatches = expressionContent.matchAll(+			new RegExp(`\\$secrets\\.(${PROVIDER_KEY_PATTERN})(?=\\.)`, 'g'),+		);+		for (const match of dotMatches) {+			providerKeys.add(match[1]);+		}++		// Match all bracket notation occurrences: $secrets['providerKey'] or $secrets["providerKey"]+		const bracketMatches = expressionContent.matchAll(+			new RegExp(`\\$secrets\\[['"](${PROVIDER_KEY_PATTERN})['"]\\]`, 'g'),+		);+		for (const match of bracketMatches) {+			providerKeys.add(match[1]);+		}+	}++	return Array.from(providerKeys);+}++export function extractProviderKeysFromCredentialData(+	data: ICredentialDataDecryptedObject,+): ReadonlySet<string> {+	const secretPaths = getExternalSecretExpressionPaths(data);+	const providerKeys = new Set<string>();++	for (const path of secretPaths) {+		const expressionString = get(data, path);+		if (typeof expressionString !== 'string') continue;+		for (const providerKey of extractProviderKeysFromExpression(expressionString)) {+			providerKeys.add(providerKey);+		}+	}++	return providerKeys;+}

+import { CredentialsFinderService } from './credentials-finder.service';+import {+	validateAccessToReferencedSecretProviders,+	validateExternalSecretsPermissions,+} from './validation';+ import { CredentialTypes } from '@/credential-types'; import { createCredentialsFromCredentialsEntity, CredentialsHelper } from '@/credentials-helper'; import { BadRequestError } from '@/errors/response-errors/bad-request.error';@@ -53,13 +63,6 @@ import { CredentialsTester } from '@/services/credentials-tester.service'; import { OwnershipService } from '@/services/ownership.service'; import { ProjectService } from '@/services/project.service.ee'; import { RoleService } from '@/services/role.service';-import { getAllKeyPaths } from '@/utils';--import { CredentialsFinderService } from './credentials-finder.service';-import {-	validateAccessToReferencedSecretProviders,-	validateExternalSecretsPermissions,-} from './validation';  export type CredentialsGetSharedOptions = 	| { allowGlobalScope: true; globalScope: Scope }@@ -69,10 +72,21 @@ type CreateCredentialOptions = CreateCredentialDto & { 	isManaged: boolean; }; +type GetManyCredentialsOptions = {+	listQueryOptions: ListQuery.Options;+	includeGlobal: boolean;+	includeData: boolean;+	onlySharedWithMe: boolean;+	filters?: {+		dependency?: CredentialDependencyFilter;+	};+};+ @Service() export class CredentialsService { 	constructor( 		private readonly credentialsRepository: CredentialsRepository,+		private readonly credentialDependencyService: CredentialDependencyService, 		private readonly sharedCredentialsRepository: SharedCredentialsRepository, 		private readonly ownershipService: OwnershipService, 		private readonly logger: Logger,@@ -93,9 +107,12 @@ export class CredentialsService { 	private async addGlobalCredentials( 		credentials: CredentialsEntity[], 		includeData: boolean,+		dependencyFilter?: CredentialDependencyFilter, 	): Promise<CredentialsEntity[]> {-		const globalCredentials =-			await this.credentialsRepository.findAllGlobalCredentials(includeData);+		const globalCredentials = await this.credentialsRepository.findAllGlobalCredentials({+			includeData,+			filters: { dependency: dependencyFilter },+		});  		// Merge and deduplicate based on credential ID 		const credentialIds = new Set(credentials.map((c) => c.id));@@ -107,23 +124,27 @@ export class CredentialsService { 	async getMany( 		user: User, 		options: {-			listQueryOptions?: ListQuery.Options & { includeData?: boolean };+			listQueryOptions?: ListQuery.Options; 			includeScopes?: boolean; 			includeData: true; 			onlySharedWithMe?: boolean; 			includeGlobal?: boolean;-			externalSecretsStore?: string;+			filters?: {+				externalSecretsStore?: string;+			}; 		}, 	): Promise<Array<ICredentialsDecrypted<ICredentialDataDecryptedObject>>>; 	async getMany( 		user: User, 		options?: {-			listQueryOptions?: ListQuery.Options & { includeData?: boolean };+			listQueryOptions?: ListQuery.Options; 			includeScopes?: boolean;

- * Detects both dot notation ($secrets.vault.key) and bracket notation ($secrets['vault']['key']).+ * Checks if a string value references `$secrets` inside an expression block.+ *+ * Detects both dot notation ($secrets.vault.key) and bracket notation ($secrets['vault']['key']) and considering that string can have whitespaces, line terminators, etc.  */ function containsExternalSecretExpression(value: string): boolean {-	const containsExpression = value.includes('{{') && value.includes('}}');

-	return value.includes('$secrets.') || value.includes('$secrets[');+	return false; }  export function getExternalSecretExpressionPaths(data: unknown): string[] {@@ -33,22 +37,27 @@ export function extractProviderKeysFromExpression(expression: string): string[] 	for (const expression of expressionBlocks) { 		const expressionContent = expression[1]; // Content inside {{ }} -		// Match provider keys in dot notation, including mixed notation:+		// Match provider keys in dot notation, including mixed notation and+		// whitespace/line terminators between the identifier and the accessor: 		// - $secrets.providerKey.secret 		// - $secrets.providerKey['secret'] 		// - $secrets.providerKey["secret"]

 		} -		// Match bracket notation occurrences where the provider key is bracket-accessed:+		// Match bracket notation occurrences where the provider key is a string+		// literal directly bracket-accessed (whitespace tolerant): 		// - $secrets['providerKey']