dank/command-center
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(log): record the full-repo secret audit (clean at 79e780f)

Browse Source 
Five layers: live-value match across all 77 revs / 765 reachable blobs; the whole
object store including the 2 dangling blobs (one synthetic sk-shaped fixture,
never committed on any ref); 21 provider shapes with every hit triaged; an
entropy scan of HEAD; all 23 git-lfs payloads (81 MiB) scanned as bytes.
Gate gap noted: hf_/npm_/pypi-/AIza/basic-auth-URL shapes are absent from
.githooks/pre-commit. Quoting the fixture literal in this commit message was
rejected by the gate, so it is described instead.

Also chmod 600 ~/.config/secrets/hf_token_write (was world-readable).
This commit is contained in:
Frank
2026-10-09 13:26:04 -07:00
parent 79e780f280
commit 1d32829428
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
omp-docs/log.md
+13
View File
@@ -11,6 +11,19 @@ timestamp: 2026-08-28
# Bundle Change Log
## 2026-10-09 — Full secret audit of the command-center repo: clean
Five-layer audit of `dank/command-center` at `79e780f`, driven by the four live values in `~/.config/secrets/` (gitea, hf_token, hf_token_write, kagi_api_key) plus 21 provider shapes (sk-, hf_, gh[pousr]_, glpat-, AKIA/ASIA, xox, npm_, pypi-, AIza, JWT, PEM/OpenSSH keys, `scheme://user:pass@host` basic-auth URLs, `password|secret|api_key = <literal>` assignments). Findings printed redacted (prefix + length + sha256 prefix).
* **Live-value scan — clean.** 77 revs (5 branches, 2 tags), 765 reachable blobs, 3.4 MiB of blob text: no known live value appears in any tracked blob at any ref.
* **Whole object store, reachable *and* dangling — clean.** `git cat-file --batch-all-objects` finds 767 blobs; 2 are unreachable, never committed on any ref (`git log --all --find-object` empty). One is a 123 KB superseded memory page; the other is a 35-byte test fixture holding a synthetic `sk-` key whose body is the alphabet followed by `1234` — pattern-minted, not issued. No PEM key, no JWT, no basic-auth URL anywhere. (Quoting the literal here tripped the secret gate, which is the gate working as designed.)
* **Shape hits, all triaged benign**: `api_key="sk-no-key-required"` (llama.cpp doc placeholder), `Set password:` / `authenticate(user, password)` prose in the Authentik memory skills, and a 40-hex string in the home-config census that is a git **packfile filename** (`pack-ff7cc541….pack`), not a token.
* **Entropy layer — clean.** Zero tokens ≥ 32 chars with Shannon entropy ≥ 4.3 in HEAD blobs.
* **Payloads, not just pointers**: all 23 git-lfs wallpaper objects (81 MiB) scanned as bytes — no secret shape in any payload.
* **Quarantine list holds**: no tracked file matches `auth.json`/`trust.json`/`.env`/`*.pem`/`*.key`/`identity*`; the 42 ignored paths on disk carry no secret shape; no credential in any git config scope (local/global/system).
* **Fixed on the spot**: `~/.config/secrets/hf_token_write` was mode 0644 (world-readable) → 0600. `~/.cache/huggingface/token` (the standard HF location, holds the same value) verified 0600.
* **Known gap, not yet closed**: `.githooks/pre-commit` covers GitHub/GitLab/Slack/AWS/PEM/JWT/OpenAI-shaped `sk-`, but **not** `hf_…`, `npm_…`, `pypi-…`, `AIza…`, Stripe, Telegram, or a `scheme://user:token@host` basic-auth URL — which is exactly the shape that sat in `remote.origin.url` until today. Widening the gate is an open decision.
## 2026-10-09 — Gitea token moved out of every remote URL
Both workstation clones (`~/.omp` → `dank/command-center`, `~/Projects/serverAppConfig` → `dank/serverAppConfigs`) carried the Gitea HTTP token inside `remote.origin.url`, so it sat in `.git/config`, was printed by `git remote -v`, and was echoed verbatim by the git-lfs lock warning on every push.