mathias/hyperguild
1
0
Fork 0
Code Issues 30 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix(scan): an allowlist was hiding a real Gitea PAT on a false justification
CI / Lint / Test / Vet (push) Successful in 32s
Details
CI / Mirror to GitHub (push) Successful in 5s
Details

Browse Source 
infra#344. The removed block suppressed
docs/superpowers/plans/2026-04-22-phase4-attempt-wiring.md, and its description
stated why:

    "Literal placeholder word REDACTED matched as if it were a token
     (verified 2026-08-04: extracted Secret == 'REDACTED' exactly, gitleaks'
      curl-auth-header rule matched the placeholder text itself, not a real
      credential)"

That is not what the file contained. Line 1054 carried a real 40-character hex
Gitea PAT in an `Authorization: token ...` header — not the eight-character word
REDACTED. Whether the file changed after the check or the check was wrong, the
justification has been guarding the wrong thing since.

Confirmed dead by side-effect before touching it, never by printing it: `GET
/api/v1/user` with that token returns 401. So there is nothing to rotate. It is
redacted here anyway, because a dead credential in a doc is still a working
example of how to write a live one, and git history keeps the original either
way.

Two independent failures had to line up, which is the same pair as infra#256:

1. The `paths` clause made the block far broader than its description. gitleaks
   ORs global allowlist clauses and ignores `condition = "AND"`, so the ENTIRE
   file was immune — a live token pasted into that doc tomorrow would have been
   suppressed on the strength of a note about a different value.
2. The justification was never re-checked against the file it justifies.

With the token redacted the allowlist has nothing left to do, so it is deleted
rather than narrowed. Repo scans clean, and a planted live-shaped credential in
that same file is now caught.

Refs: mathias/infra#344, mathias/infra#256, mathias/infra#317
This commit is contained in:
mathias
2026-08-31 07:24:07 +02:00
parent 05330ad54a
commit 42235dcb6a
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitleaks.toml
+13 -5
View File
@@ -56,8 +56,16 @@ paths = [
'''ingestion/internal/claudewatcher/watcher_test\.go$''',
]
[[allowlists]]
description = "Literal placeholder word REDACTED matched as if it were a token (verified 2026-08-04: extracted Secret == 'REDACTED' exactly, gitleaks' curl-auth-header rule matched the placeholder text itself, not a real credential)"
condition = "AND"
paths = ['''docs/superpowers/plans/2026-04-22-phase4-attempt-wiring\.md$''']
regexes = ['''REDACTED''']
# infra#344: the allowlist that used to sit here is gone, and so is the reason
# for it. It suppressed docs/superpowers/plans/2026-04-22-phase4-attempt-wiring.md
# on the stated grounds that "extracted Secret == 'REDACTED' exactly ... the
# placeholder text itself, not a real credential" (verified 2026-08-04). That was
# not what the file contained: line 1054 carried a real 40-char hex Gitea PAT in
# an `Authorization: token ...` header. Confirmed dead by side-effect — GET
# /api/v1/user with it returns 401 — and redacted in that file, so there is now
# nothing to allowlist.
#
# The `paths` entry also made the block far broader than its description: gitleaks
# ORs global allowlist clauses and ignores `condition = "AND"`, so the whole file
# was immune, not just lines matching /REDACTED/. A live token added to that doc
# would have been suppressed on the strength of a note about a different value.