Files

T

gramps 826cc17e47 TASK 56: the secret scan is done - and the history is clean

The release gate before the repo goes public. Scanned 432 reachable commits (all
branches, 35 tags, the reflog, refs/stash) + the 63 dangling commits git fsck still
holds + every tracked file in the worktree, for Google OAuth client secrets, API
keys/tokens (Polar OAT, ghp_, AKIA, Slack, Stripe, OpenAI), private-key headers,
assigned credentials, and any once-tracked CREDENTIALS.md / OAuthCredentials.cs /
MARCOM.md. Report format is commit + path + rule only - no matched value ever
reaches the screen.

Result: 4 hits, ALL false positives - README.md:79 is the doc snippet's
'ClientSecret = your-client-secret' placeholder, TokenStoreTests.cs:22 is a 9-char
test dummy. Nothing to rotate, no history rewrite. The three secret files were
never tracked.

Also recorded: the repo was ALREADY public when the scan ran (anonymous GET -> 200,
API private=false), so the gate came late - but nothing leaked. The creator still
owns the keep-it-public decision.

Method + verdict in TASKS/task-56-secret-scan.md; the reusable recipe in
MyMistakes.md -> 2026-10-22.

2026-10-22 06:43:55 -07:00

3.7 KiB

Raw Blame History

TASK 56 — Pre-publication secret scan of the full git history (✅ done 2026-10-22)

Catalog: TASKS.md — status and requirements live here.

Why: the creator is switching the Gitea repo (https://llgit.llamachile.tube/gramps/LlamaCasty) to public (GPL-3.0-or-later release). The working tree is clean — CREDENTIALS.md, MARCOM.md, and Helpers/OAuthCredentials.cs are gitignored and were never committed — but every past commit becomes readable too. Anything ever committed by mistake would be exposed.

Gate: do this BEFORE the repo is toggled public.

Slices:

✅ Scan every commit, every branch for secret-shaped content: Google OAuth client secrets (GOCSPX-), API keys / tokens (Polar OAT, ghp_, AKIA, private-key headers), passwords, stream keys, and any once-tracked CREDENTIALS.md / OAuthCredentials.cs. ⛔ Report commit + path + rule only — never print a matched value (see MyMistakes.md → "NEVER PRINT CREDENTIALS.md"). A tool like gitleaks with --redact, or git log -p piped to a counter, never to the screen.
✅ If anything is found: rotate that secret first (it's burned regardless), then decide with the creator: rewrite history (git filter-repo) vs. accept the rotated value staying in history. Nothing was found → nothing to rotate.
✅ Record the result (clean / what was rotated) here and in HANDOFF.md.

RESULT — 2026-10-22: CLEAN (0 real secrets)

Coverage: 432 reachable commits (all branches, all 35 tags, the reflog and refs/stash) + the 63 unreachable commits git fsck still holds + every tracked file in the worktree.

Findings: 4 hits, all false positives (report = commit + path + rule only, no values printed):

commit	path	rule	verdict
`4e42871`	`README.md:79`	assigned-credential	placeholder — the doc snippet `ClientSecret = "your-client-secret"`
`4afe11e`	`ytLive.Tests/TokenStoreTests.cs:22`	assigned-credential	test fixture — a 9-char dummy access token
WORKTREE	`README.md:79`	assigned-credential	same placeholder, still in the tree
WORKTREE	`ytLive.Tests/TokenStoreTests.cs:22`	assigned-credential	same test dummy, still in the tree

Nothing to rotate. No history rewrite needed. CREDENTIALS.md, MARCOM.md and Helpers/OAuthCredentials.cs were never tracked (they are in .gitignore, and no commit ever added them) — the "once-tracked secret file" rule matched nothing.

⚠️ The gate was blown before the scan ran: the repo is already public — an anonymous GET https://llgit.llamachile.tube/gramps/LlamaCasty returns HTTP 200, and the API reports private = false. The scan came back clean, so nothing was exposed; the ordering was simply late. The creator still owns the decision to keep the repo public.

The method (reusable — the scan is a one-liner over `git log -p`)

# pipe the history into a matcher; print ONLY sha + path + rule, never the matched text
git log --all --reflog -p --unified=0 --format='@@@%H' | <matcher>

--all = every branch + tag; --reflog also covers commits that were reset away (they are still recoverable by SHA, so they count); refs/stash is included via --all.
git fsck --unreachable lists the dangling commits no ref points at — scan those too (git show -p <sha> per SHA).
Track the current file (path) from the +++ b/<path> line and attribute each hit to it.
Classify a hit without printing it: compare it against known placeholders (your-client-secret) and test-marker words (test, dummy, fake, example), and print only the verdict + length. A rule match is a lead, not a finding.

3.7 KiB Raw Blame History

TASK 56 — Pre-publication secret scan of the full git history (✅ done 2026-10-22)

RESULT — 2026-10-22: CLEAN (0 real secrets)

The method (reusable — the scan is a one-liner over git log -p)

3.7 KiB

Raw Blame History

The method (reusable — the scan is a one-liner over `git log -p`)