gramps
826cc17e47
The release gate before the repo goes public. Scanned 432 reachable commits (all branches, 35 tags, the reflog, refs/stash) + the 63 dangling commits git fsck still holds + every tracked file in the worktree, for Google OAuth client secrets, API keys/tokens (Polar OAT, ghp_, AKIA, Slack, Stripe, OpenAI), private-key headers, assigned credentials, and any once-tracked CREDENTIALS.md / OAuthCredentials.cs / MARCOM.md. Report format is commit + path + rule only - no matched value ever reaches the screen. Result: 4 hits, ALL false positives - README.md:79 is the doc snippet's 'ClientSecret = your-client-secret' placeholder, TokenStoreTests.cs:22 is a 9-char test dummy. Nothing to rotate, no history rewrite. The three secret files were never tracked. Also recorded: the repo was ALREADY public when the scan ran (anonymous GET -> 200, API private=false), so the gate came late - but nothing leaked. The creator still owns the keep-it-public decision. Method + verdict in TASKS/task-56-secret-scan.md; the reusable recipe in MyMistakes.md -> 2026-10-22.
62 lines
3.7 KiB
Markdown
62 lines
3.7 KiB
Markdown
# TASK 56 — Pre-publication secret scan of the full git history (✅ done 2026-10-22)
|
|
|
|
> Catalog: [`TASKS.md`](../TASKS.md) — status and requirements live here.
|
|
|
|
**Why:** the creator is switching the Gitea repo (`https://llgit.llamachile.tube/gramps/LlamaCasty`)
|
|
to **public** (GPL-3.0-or-later release). The working tree is clean — `CREDENTIALS.md`,
|
|
`MARCOM.md`, and `Helpers/OAuthCredentials.cs` are gitignored and were never committed — but every
|
|
past commit becomes readable too. Anything ever committed by mistake would be exposed.
|
|
|
|
**Gate:** do this BEFORE the repo is toggled public.
|
|
|
|
**Slices:**
|
|
|
|
1. ✅ **Scan every commit, every branch** for secret-shaped content: Google OAuth client secrets
|
|
(`GOCSPX-`), API keys / tokens (Polar OAT, `ghp_`, `AKIA`, private-key headers), passwords,
|
|
stream keys, and any once-tracked `CREDENTIALS.md` / `OAuthCredentials.cs`.
|
|
⛔ **Report commit + path + rule only — never print a matched value** (see `MyMistakes.md` →
|
|
"NEVER PRINT CREDENTIALS.md"). A tool like gitleaks with `--redact`, or `git log -p` piped to a
|
|
counter, never to the screen.
|
|
2. ✅ **If anything is found:** rotate that secret first (it's burned regardless), then decide with
|
|
the creator: rewrite history (`git filter-repo`) vs. accept the rotated value staying in history.
|
|
**Nothing was found → nothing to rotate.**
|
|
3. ✅ Record the result (clean / what was rotated) here and in `HANDOFF.md`.
|
|
|
|
## RESULT — 2026-10-22: CLEAN (0 real secrets)
|
|
|
|
**Coverage:** 432 reachable commits (all branches, all 35 tags, the reflog and `refs/stash`) + the
|
|
63 unreachable commits `git fsck` still holds + every tracked file in the worktree.
|
|
|
|
**Findings: 4 hits, all false positives** (report = commit + path + rule only, no values printed):
|
|
|
|
| commit | path | rule | verdict |
|
|
|---|---|---|---|
|
|
| `4e42871` | `README.md:79` | assigned-credential | **placeholder** — the doc snippet `ClientSecret = "your-client-secret"` |
|
|
| `4afe11e` | `ytLive.Tests/TokenStoreTests.cs:22` | assigned-credential | **test fixture** — a 9-char dummy access token |
|
|
| WORKTREE | `README.md:79` | assigned-credential | same placeholder, still in the tree |
|
|
| WORKTREE | `ytLive.Tests/TokenStoreTests.cs:22` | assigned-credential | same test dummy, still in the tree |
|
|
|
|
**Nothing to rotate. No history rewrite needed.** `CREDENTIALS.md`, `MARCOM.md` and
|
|
`Helpers/OAuthCredentials.cs` were **never tracked** (they are in `.gitignore`, and no commit
|
|
ever added them) — the "once-tracked secret file" rule matched nothing.
|
|
|
|
⚠️ **The gate was blown before the scan ran:** the repo is **already public** — an anonymous
|
|
`GET https://llgit.llamachile.tube/gramps/LlamaCasty` returns **HTTP 200**, and the API reports
|
|
`private = false`. The scan came back clean, so nothing was exposed; the ordering was simply
|
|
late. The creator still owns the decision to keep the repo public.
|
|
|
|
## The method (reusable — the scan is a one-liner over `git log -p`)
|
|
|
|
```bash
|
|
# pipe the history into a matcher; print ONLY sha + path + rule, never the matched text
|
|
git log --all --reflog -p --unified=0 --format='@@@%H' | <matcher>
|
|
```
|
|
- `--all` = every branch + tag; `--reflog` also covers commits that were reset away (they are
|
|
still recoverable by SHA, so they count); `refs/stash` is included via `--all`.
|
|
- `git fsck --unreachable` lists the **dangling** commits no ref points at — scan those too
|
|
(`git show -p <sha>` per SHA).
|
|
- Track the current file (`path`) from the `+++ b/<path>` line and attribute each hit to it.
|
|
- **Classify a hit without printing it**: compare it against known placeholders
|
|
(`your-client-secret`) and test-marker words (`test`, `dummy`, `fake`, `example`), and print
|
|
only the verdict + length. A rule match is a *lead*, not a finding.
|