[A-03] History contains user data and binaries #39

New issue

Open

opened 2026-10-11 20:15:34 -05:00 by pyaniz · 2 comments

pyaniz commented

2026-10-11 20:15:34 -05:00

Owner

Audit ID: A-03 · Priority: P1 · Effort: L

History contains user data and binaries. SQLite DBs with users, Telegram handles and emails (data/thursday.db, 100+ data/backup/hourly/*.db, pre_migration_*.db, thursday.db), backend/manual_snapshot.sql (1.7 MB), code_backup_v2.zip, and three ~65 MB release zips. Pack size is 55 MB. Action: purge with git filter-repo, force-push, tell collaborators to re-clone, and re-sync the GitHub mirror. This is destructive, so it needs a plan.

Source: AUDIT_FINDINGS.md (audit 2026-10-11). Items marked (verify) need confirming first.

**Audit ID:** A-03 · **Priority:** P1 · **Effort:** L **History contains user data and binaries.** SQLite DBs with users, Telegram handles and emails (`data/thursday.db`, 100+ `data/backup/hourly/*.db`, `pre_migration_*.db`, `thursday.db`), `backend/manual_snapshot.sql` (1.7 MB), `code_backup_v2.zip`, and three ~65 MB release zips. Pack size is 55 MB. **Action:** purge with `git filter-repo`, force-push, tell collaborators to re-clone, and re-sync the GitHub mirror. This is destructive, so it needs a plan. Source: `AUDIT_FINDINGS.md` (audit 2026-10-11). Items marked *(verify)* need confirming first.

pyaniz added the

audit

security

labels

2026-10-11 20:15:34 -05:00

pyaniz referenced this issue

2026-10-11 20:19:57 -05:00

[Maintenance] Clean up remaining SQLite references in the code #68

pyaniz commented

2026-10-11 20:19:57 -05:00

Author

Owner

SQLite is no longer in use. The local .db files (116, ~530 MB: pre_migration_*, hourly backups, thursday.db) were deleted from the working directory, and the leftover gitignore patterns and stale comment were removed in 7efdd12. The history purge here is now confirmed safe for all SQLite files. Remaining code references: #68.

SQLite is no longer in use. The local `.db` files (116, ~530 MB: `pre_migration_*`, hourly backups, `thursday.db`) were deleted from the working directory, and the leftover gitignore patterns and stale comment were removed in `7efdd12`. The history purge here is now confirmed safe for all SQLite files. Remaining code references: #68.

pyaniz referenced this issue

2026-10-24 17:32:36 -05:00

[A-01] Real secrets are in git history #37

pyaniz commented

2026-10-24 17:32:37 -05:00

Author

Owner

Priority lowered from P1 to P2: the leaked secrets were rotated (#37), so the purge is now mainly about repo size (55 MB pack) and old user-data DB files in history. Still destructive (filter-repo, force-push, re-clone), so it needs a plan.

pyaniz added

and removed

labels

2026-10-24 17:32:38 -05:00