From 692244d2139d52e4148a17464e21966b920834e1 Mon Sep 17 00:00:00 2001 From: Mathias Date: Sat, 29 Aug 2026 10:04:11 +0200 Subject: [PATCH] security: disposition the one historical gitleaks finding (infra#326) A Gitea PAT was pasted into a CD-watching curl command in a 2026-04-22 planning doc (c9310b10, last_eight 3105a670). Verified dead before dispositioning it, rather than assuming: authenticating GET /api/v1/user with that exact value returns 401. It was almost certainly invalidated by the early-August rotation of the `mathias` PATs -- the same rotation whose fan-out caused infra#260, where CI's stale copies kept failing. So it was killed for unrelated reasons, by luck rather than by the leak being noticed. No rotation outstanding. `task security:gitleaks:history` now exits 0 here. Used .gitleaksignore (per-finding fingerprint) rather than a path allowlist in .gitleaks.toml: a path allowlist would also blind the working-tree scan that gates commits. Verified both directions -- history 1 -> 0, working tree still clean. --- .gitleaksignore | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .gitleaksignore diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 0000000..04b1187 --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,33 @@ +# Historical gitleaks findings, dispositioned (infra#326 / infra#317). +# +# WHY THIS FILE AND NOT .gitleaks.toml: +# This is a finding in git HISTORY, surfaced by the full-history audit +# (`task security:gitleaks:history`). The working-tree scan that gates commits +# (`task security:gitleaks`, the pre-commit hook, CI) is clean. Suppressing by +# PATH in .gitleaks.toml would also blind the working-tree scan for that file +# forever; a fingerprint pins one finding in one commit, so a NEW secret in the +# same file still fires. +# +# History is not rewritten here, so the remediation for a real leak is +# ROTATION -- making the committed value worthless -- never scrubbing. +# +# Dispositioned 2026-08-29. Re-check with: task security:gitleaks:history + +# --- Real credential, ALREADY DEAD ------------------------------------------- +# A Gitea PAT pasted into a CD-watching command in a planning doc +# (`Authorization: token <40-hex>`, last_eight 3105a670). +# +# Verified dead 2026-08-29: authenticating against +# GET https://git.d-ma.be/api/v1/user with this exact value returns 401, so the +# committed token no longer grants anything. It was almost certainly invalidated +# by the early-August rotation of the `mathias` PATs (the same rotation whose +# fan-out caused infra#260, where CI copies of the old value kept failing). +# +# No rotation action outstanding. Kept as a fingerprint rather than removed from +# history because history cannot be rewritten here. +# +# The generalisable lesson is recorded separately: a credential printed into a +# doc/transcript is permanent, so the only remedy is rotating it -- which in +# this case had already happened for unrelated reasons, by luck rather than by +# the leak being noticed. +c9310b1079478bf4430b0a2dfb25445d7ccc9b59:docs/superpowers/plans/2026-04-22-phase4-attempt-wiring.md:curl-auth-header:1053