mathias
692244d213
A Gitea PAT was pasted into a CD-watching curl command in a 2026-04-22
planning doc (c9310b10, last_eight 3105a670).
Verified dead before dispositioning it, rather than assuming: authenticating
GET /api/v1/user with that exact value returns 401. It was almost certainly
invalidated by the early-August rotation of the `mathias` PATs -- the same
rotation whose fan-out caused infra#260, where CI's stale copies kept
failing. So it was killed for unrelated reasons, by luck rather than by the
leak being noticed.
No rotation outstanding. `task security:gitleaks:history` now exits 0 here.
Used .gitleaksignore (per-finding fingerprint) rather than a path allowlist
in .gitleaks.toml: a path allowlist would also blind the working-tree scan
that gates commits. Verified both directions -- history 1 -> 0, working tree
still clean.
34 lines
1.8 KiB
Plaintext
34 lines
1.8 KiB
Plaintext
# Historical gitleaks findings, dispositioned (infra#326 / infra#317).
|
|
#
|
|
# WHY THIS FILE AND NOT .gitleaks.toml:
|
|
# This is a finding in git HISTORY, surfaced by the full-history audit
|
|
# (`task security:gitleaks:history`). The working-tree scan that gates commits
|
|
# (`task security:gitleaks`, the pre-commit hook, CI) is clean. Suppressing by
|
|
# PATH in .gitleaks.toml would also blind the working-tree scan for that file
|
|
# forever; a fingerprint pins one finding in one commit, so a NEW secret in the
|
|
# same file still fires.
|
|
#
|
|
# History is not rewritten here, so the remediation for a real leak is
|
|
# ROTATION -- making the committed value worthless -- never scrubbing.
|
|
#
|
|
# Dispositioned 2026-08-29. Re-check with: task security:gitleaks:history
|
|
|
|
# --- Real credential, ALREADY DEAD -------------------------------------------
|
|
# A Gitea PAT pasted into a CD-watching command in a planning doc
|
|
# (`Authorization: token <40-hex>`, last_eight 3105a670).
|
|
#
|
|
# Verified dead 2026-08-29: authenticating against
|
|
# GET https://git.d-ma.be/api/v1/user with this exact value returns 401, so the
|
|
# committed token no longer grants anything. It was almost certainly invalidated
|
|
# by the early-August rotation of the `mathias` PATs (the same rotation whose
|
|
# fan-out caused infra#260, where CI copies of the old value kept failing).
|
|
#
|
|
# No rotation action outstanding. Kept as a fingerprint rather than removed from
|
|
# history because history cannot be rewritten here.
|
|
#
|
|
# The generalisable lesson is recorded separately: a credential printed into a
|
|
# doc/transcript is permanent, so the only remedy is rotating it -- which in
|
|
# this case had already happened for unrelated reasons, by luck rather than by
|
|
# the leak being noticed.
|
|
c9310b1079478bf4430b0a2dfb25445d7ccc9b59:docs/superpowers/plans/2026-04-22-phase4-attempt-wiring.md:curl-auth-header:1053
|