From a04a2c27a9381a91224e08ec53085ffadcb246d7 Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 16 Sep 2026 21:10:45 -0700 Subject: [PATCH] AGENTS.md: a token on a curl command line is world-readable Checking whether a download was still running with pgrep -a curl printed the whole argv, Authorization header included, into the session transcript. The token is not in the repo and nothing was committed, but the practice is wrong: secrets belong in a -K config file or the environment, not in argv, and no pgrep -a should ever target a command carrying an auth header. --- AGENTS.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index a9dbe8e..2d0263b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -156,6 +156,13 @@ See `serverAppConfigs-docs/Architecture/Testing Policy.md`. credentials). - Do not document passwords anywhere in the repo. SSH keys are the auth mechanism; `FRANK_SUDO_PW` covers headless sudo and never enters the repo. +- **A token passed as `curl -H "Authorization: Bearer …"` is world-readable.** + It lands in `/proc//cmdline`, so any `ps`/`pgrep -a` on the host prints + it — that leaked an HF token into a session transcript on 2026-09-16, while + merely checking whether a download was still running. Pass secrets out of + band (`curl -K ` carrying the header, or `HF_TOKEN` in the + environment for `hf`/`hf_transfer`) and never `pgrep -a` a fetch command that + carries an auth header. ## External Exposure Policy (MANDATORY)