gramps/LlamaCasty
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

TASK 56: the secret scan is done - and the history is clean

Browse Source 
The release gate before the repo goes public. Scanned 432 reachable commits (all
branches, 35 tags, the reflog, refs/stash) + the 63 dangling commits git fsck still
holds + every tracked file in the worktree, for Google OAuth client secrets, API
keys/tokens (Polar OAT, ghp_, AKIA, Slack, Stripe, OpenAI), private-key headers,
assigned credentials, and any once-tracked CREDENTIALS.md / OAuthCredentials.cs /
MARCOM.md. Report format is commit + path + rule only - no matched value ever
reaches the screen.

Result: 4 hits, ALL false positives - README.md:79 is the doc snippet's
'ClientSecret = your-client-secret' placeholder, TokenStoreTests.cs:22 is a 9-char
test dummy. Nothing to rotate, no history rewrite. The three secret files were
never tracked.

Also recorded: the repo was ALREADY public when the scan ran (anonymous GET -> 200,
API private=false), so the gate came late - but nothing leaked. The creator still
owns the keep-it-public decision.

Method + verdict in TASKS/task-56-secret-scan.md; the reusable recipe in
MyMistakes.md -> 2026-10-22.
This commit is contained in:
gramps
2026-10-22 06:43:55 -07:00
parent 8be6a83dab
commit 826cc17e47
4 changed files with 75 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MyMistakes.md
+24
View File
@@ -2274,3 +2274,27 @@ settled the design in one run. **Probe, then code** — this is not in any WPF b
sizes to its **content**, not to the ComboBox — measured 142.7px of popup for a 100px ComboBox
whose rows read "swatch + hex + name". A long row is never clipped, and the popup may be wider
than the closed box. Measure with `ActualWidth` in a throwaway test; do not guess widths.
## 2026-10-22 — SCANNING A GIT HISTORY FOR SECRETS WITHOUT EVER PRINTING ONE (RECIPE)
A release gate ("the repo goes public — check the history first"). The rule from
`MyMistakes.md` → "NEVER PRINT CREDENTIALS.md" applies to the SCAN too: a matched value must
never reach the screen, the transcript, or a log file.
**The pipeline:** `git log --all --reflog -p --unified=0 --format='@@@%H'` piped into a matcher
that prints **only `sha | path | rule`**. Three details that decide coverage:
- `--all` covers every branch and tag; **`--reflog` is not optional** — a commit that was
`reset` away is still reachable by SHA, so it is still exposed; `refs/stash` comes along too.
- **`git fsck --unreachable`** lists the dangling commits no ref points at. They are in the
object store and recoverable by SHA, so scan them (`git show -p <sha>` per SHA).
- The current file comes from the `+++ b/<path>` line; without it every hit is unattributable.
**A rule match is a LEAD, not a finding — classify it without printing it:** compare the match
against known placeholders (`your-client-secret`) and test-marker words (`test`, `dummy`, `fake`,
`example`) and print only the verdict + length. In this repo's scan, 4 hits were all
false positives (a doc placeholder and a unit-test dummy) and 2 real secrets were not present —
so the honest report was "4 hits, all false positives", not "4 leaks".
**Never print a matched value — but still say WHAT it is.** The report format that satisfies both:
commit + path + line + rule + verdict. "README.md:79 | assigned-credential | placeholder" is
actionable; the same report without the verdict forces the reader to go look at the secret.