24 lines
1.4 KiB
Markdown
24 lines
1.4 KiB
Markdown
# TASK 56 — Pre-publication secret scan of the full git history (queued 2026-10-09)
|
|
|
|
> Catalog: [`TASKS.md`](../TASKS.md) — status and requirements live here.
|
|
|
|
**Why:** the creator is switching the Gitea repo (`https://llgit.llamachile.tube/gramps/LlamaCasty`)
|
|
to **public** (GPL-3.0-or-later release). The working tree is clean — `CREDENTIALS.md`,
|
|
`MARCOM.md`, and `Helpers/OAuthCredentials.cs` are gitignored and were never committed — but every
|
|
past commit becomes readable too. Anything ever committed by mistake would be exposed.
|
|
|
|
**Gate:** do this BEFORE the repo is toggled public.
|
|
|
|
**Slices:**
|
|
|
|
1. ☐ **Scan every commit, every branch** for secret-shaped content: Google OAuth client secrets
|
|
(`GOCSPX-`), API keys / tokens (Polar OAT, `ghp_`, `AKIA`, private-key headers), passwords,
|
|
stream keys, and any once-tracked `CREDENTIALS.md` / `OAuthCredentials.cs`.
|
|
⛔ **Report commit + path + rule only — never print a matched value** (see `MyMistakes.md` →
|
|
"NEVER PRINT CREDENTIALS.md"). A tool like gitleaks with `--redact`, or `git log -p` piped to a
|
|
counter, never to the screen.
|
|
2. ☐ **If anything is found:** rotate that secret first (it's burned regardless), then decide with
|
|
the creator: rewrite history (`git filter-repo`) vs. accept the rotated value staying in history.
|
|
3. ☐ Record the result (clean / what was rotated) here and in `HANDOFF.md`, then the creator flips
|
|
the repo public.
|