[A-02] Local `.env` holds more live credentials #38

New issue

Closed

opened 2026-10-11 20:15:34 -05:00 by pyaniz · 1 comment

pyaniz commented

2026-10-11 20:15:34 -05:00

Owner

Audit ID: A-02 · Priority: P0 · Effort: S

Local .env holds more live credentials (FORGEJO_TOKEN, DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET). It is gitignored, so this is local exposure only. Action: confirm none was ever committed (not found in history) and keep them out of any shared/synced folder.

Source: AUDIT_FINDINGS.md (audit 2026-10-11). Items marked (verify) need confirming first.

**Audit ID:** A-02 · **Priority:** P0 · **Effort:** S **Local `.env` holds more live credentials** (`FORGEJO_TOKEN`, `DISCORD_BOT_TOKEN`, `DISCORD_CLIENT_SECRET`). It is gitignored, so this is local exposure only. **Action:** confirm none was ever committed (not found in history) and keep them out of any shared/synced folder. Source: `AUDIT_FINDINGS.md` (audit 2026-10-11). Items marked *(verify)* need confirming first.

pyaniz added the

audit

security

labels

2026-10-11 20:15:34 -05:00

pyaniz commented

2026-10-24 17:32:37 -05:00

Author

Owner

Re-checked 2026-10-24: .env is gitignored and untracked, and a history search found no DISCORD_CLIENT_SECRET or FORGEJO_TOKEN ever committed. Local exposure only. Closing.

pyaniz closed this issue

2026-10-24 17:32:37 -05:00