# TASK 56 — Pre-publication secret scan of the full git history (✅ done 2026-10-22)

> Catalog: [`TASKS.md`](../TASKS.md) — status and requirements live here.

**Why:** the creator is switching the Gitea repo (`https://llgit.llamachile.tube/gramps/LlamaCasty`)
to **public** (GPL-3.0-or-later release). The working tree is clean — `CREDENTIALS.md`,
`MARCOM.md`, and `Helpers/OAuthCredentials.cs` are gitignored and were never committed — but every
past commit becomes readable too. Anything ever committed by mistake would be exposed.

**Gate:** do this BEFORE the repo is toggled public.

**Slices:**

1. ✅ **Scan every commit, every branch** for secret-shaped content: Google OAuth client secrets
   (`GOCSPX-`), API keys / tokens (Polar OAT, `ghp_`, `AKIA`, private-key headers), passwords,
   stream keys, and any once-tracked `CREDENTIALS.md` / `OAuthCredentials.cs`.
   ⛔ **Report commit + path + rule only — never print a matched value** (see `MyMistakes.md` →
   "NEVER PRINT CREDENTIALS.md"). A tool like gitleaks with `--redact`, or `git log -p` piped to a
   counter, never to the screen.
2. ✅ **If anything is found:** rotate that secret first (it's burned regardless), then decide with
   the creator: rewrite history (`git filter-repo`) vs. accept the rotated value staying in history.
   **Nothing was found → nothing to rotate.**
3. ✅ Record the result (clean / what was rotated) here and in `HANDOFF.md`.

## RESULT — 2026-10-22: CLEAN (0 real secrets)

**Coverage:** 432 reachable commits (all branches, all 35 tags, the reflog and `refs/stash`) + the
63 unreachable commits `git fsck` still holds + every tracked file in the worktree.

**Findings: 4 hits, all false positives** (report = commit + path + rule only, no values printed):

| commit | path | rule | verdict |
|---|---|---|---|
| `4e42871` | `README.md:79` | assigned-credential | **placeholder** — the doc snippet `ClientSecret = "your-client-secret"` |
| `4afe11e` | `ytLive.Tests/TokenStoreTests.cs:22` | assigned-credential | **test fixture** — a 9-char dummy access token |
| WORKTREE | `README.md:79` | assigned-credential | same placeholder, still in the tree |
| WORKTREE | `ytLive.Tests/TokenStoreTests.cs:22` | assigned-credential | same test dummy, still in the tree |

**Nothing to rotate. No history rewrite needed.** `CREDENTIALS.md`, `MARCOM.md` and
`Helpers/OAuthCredentials.cs` were **never tracked** (they are in `.gitignore`, and no commit
ever added them) — the "once-tracked secret file" rule matched nothing.

⚠️ **The gate was blown before the scan ran:** the repo is **already public** — an anonymous
`GET https://llgit.llamachile.tube/gramps/LlamaCasty` returns **HTTP 200**, and the API reports
`private = false`. The scan came back clean, so nothing was exposed; the ordering was simply
late. The creator still owns the decision to keep the repo public.

## The method (reusable — the scan is a one-liner over `git log -p`)

```bash
# pipe the history into a matcher; print ONLY sha + path + rule, never the matched text
git log --all --reflog -p --unified=0 --format='@@@%H' | <matcher>
```
- `--all` = every branch + tag; `--reflog` also covers commits that were reset away (they are
  still recoverable by SHA, so they count); `refs/stash` is included via `--all`.
- `git fsck --unreachable` lists the **dangling** commits no ref points at — scan those too
  (`git show -p <sha>` per SHA).
- Track the current file (`path`) from the `+++ b/<path>` line and attribute each hit to it.
- **Classify a hit without printing it**: compare it against known placeholders
  (`your-client-secret`) and test-marker words (`test`, `dummy`, `fake`, `example`), and print
  only the verdict + length. A rule match is a *lead*, not a finding.