pyaniz/Thursday
Watch
1
1
Fork
You've already forked Thursday
 0
Code Issues 30 Pull requests Projects Releases Packages 1 Wiki Activity Actions

[A-01] Real secrets are in git history #37

New issue
Closed
opened 2026-10-11 20:15:34 -05:00 by pyaniz · 1 comment
pyaniz commented 2026-10-11 20:15:34 -05:00
Owner

Audit ID: A-01 · Priority: P0 · Effort: M

Real secrets are in git history. .env was committed in 5 commits (2025-12-23 to 2025-12-29, deleted in 2b830d3). It held the Telegram bot token, the Google service-account private key, SECRET_KEY, the BGG token and an admin handle. History exists on origin (all 3 branches) and the github-mirror.yml workflow pushes it to GitHub. Action: rotate every one (BotFather token, Google key, SECRET_KEY, BGG token). Check whether the GitHub mirror is public. Then decide on a history purge (A-03).

Source: AUDIT_FINDINGS.md (audit 2026-10-11). Items marked (verify) need confirming first.

**Audit ID:** A-01 · **Priority:** P0 · **Effort:** M **Real secrets are in git history.** `.env` was committed in 5 commits (2025-12-23 to 2025-12-29, deleted in `2b830d3`). It held the Telegram bot token, the Google service-account private key, `SECRET_KEY`, the BGG token and an admin handle. History exists on `origin` (all 3 branches) and the `github-mirror.yml` workflow pushes it to GitHub. **Action:** rotate every one (BotFather token, Google key, `SECRET_KEY`, BGG token). Check whether the GitHub mirror is public. Then decide on a history purge (A-03). Source: `AUDIT_FINDINGS.md` (audit 2026-10-11). Items marked *(verify)* need confirming first.
pyaniz commented 2026-10-24 17:32:36 -05:00
Author
Owner

Re-checked 2026-10-24: the secrets are still in git history (.env in 5 commits, Google private key included), but the Telegram bot token, Google service-account key, SECRET_KEY and BGG token have been rotated, so the leaked values are dead. The GitHub mirror is not publicly reachable (404). The remaining history purge is tracked in #39. Closing.

Re-checked 2026-10-24: the secrets are still in git history (.env in 5 commits, Google private key included), but the Telegram bot token, Google service-account key, SECRET_KEY and BGG token have been rotated, so the leaked values are dead. The GitHub mirror is not publicly reachable (404). The remaining history purge is tracked in #39. Closing.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
staging
feature/game-details-rework
feature/sleeves
versell
No results found.
Labels
Clear labels   
audit

   
bug
Something is not working

  
cleanup

   
docs

   
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
new feature
This feature doesn't exist and needs to be created

  
P0

   
P1

   
P2

   
P3

   
question
More information is needed

  
roadmap
Tasks from the official roadmap

  
security

   
wontfix
This won't be fixed

No labels
audit
bug
cleanup
docs
duplicate
enhancement
help wanted
invalid
new feature
P0
P1
P2
P3
question
roadmap
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
pyaniz/Thursday#37
No description provided.