From 99a5586dc7dd099e76e50f6374cb413a266ad265 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Thu, 30 Jul 2026 19:21:00 +0000 Subject: [PATCH] chore(security): pin the env-backup findings in .gitleaksignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `gitleaks detect` scans history, so the 21 findings from the environment backup committed in cfb23d2 (#160) keep failing the scan no matter what HEAD contains — untracking the file did nothing for them. The alternative is rewriting master to drop the blob, which forces all 8 collaborators to re-clone and still leaves the objects on GitHub's servers. Appended to the existing ignore list rather than replacing it; the two false-positive pins already there (the docs placeholder and the tracker test fixture) are untouched. These 21 differ from those two in kind: the values were real, not false positives. Pinning them is only honest after rotation, since rotation is what makes the recorded values dead. The file says so, at length, where the next person to read it will see it. Verified against a pristine clone of master with gitleaks 8.21.2 — the same version CI installs: 21 findings before, "no leaks found" after. Co-Authored-By: Claude Opus 5 (1M context) --- .gitleaksignore | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/.gitleaksignore b/.gitleaksignore index 022fe367..b84335ac 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -13,3 +13,38 @@ # tag fixture for the tracker integration analyzer test. Not a real secret — # it's asserted on by the test, so pin the historical blob rather than rewrite. 64a771186801871e191fb913b801b086d9ef3235:tests/contract/tracker-integrations.test.ts:generic-api-key:8 + +# --------------------------------------------------------------------------- +# .env.bak-2026-07-28 — a local environment backup committed to master in +# 925da5e (#160, 2026-07-28) and untracked again later. Unlike the two entries +# above, these were NOT false positives: the values were real. They are pinned +# here because `gitleaks detect` scans history, so it reports the original +# commit no matter what HEAD contains, and rewriting master to drop the blob +# would force every collaborator to re-clone. +# +# These pins are only honest because the credentials have been rotated — once +# rotated, the recorded values are dead and the finding is genuinely stale. +# If rotation did not happen, this section is hiding a live exposure. +# +# Scoped to that one commit and file, so any NEW leak still fails the scan. +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:gcp-api-key:54 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:101 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:11 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:12 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:15 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:20 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:24 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:27 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:37 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:40 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:56 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:58 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:60 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:62 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:64 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:81 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:83 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:90 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:91 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:generic-api-key:98 +925da5e21bfd6f91b45f9ef0a27b490573fc3615:.env.bak-2026-07-28:private-key:92