Automated full-codebase security review
Workflow run: https://github.com/ahjota/dotfiles/actions/runs/34365815325
Session: 9b80a8f9-5b60-4cb5-8934-ab5be27bb0b2
Summary
The full-codebase review found one low-severity information-disclosure issue in the Starship prompt configuration. No shell-injection vectors, unquoted variable expansions, hardcoded secrets, unsafe curl | sh patterns, or chezmoi template evaluation risks with a realistic exploit path were identified. CI downloads are pinned and SHA-256 verified, GitHub Actions use minimal scoped permissions, and work-only credential handling is properly gated.
Findings
1. Starship prompt renders DataRobot endpoint hostname (information disclosure)
- Severity: Low
- File:
private_dot_config/starship.toml.tmpl (lines 85–99)
- Description: The
custom.drconfig segment extracts the DataRobot endpoint from ~/.config/datarobot/drconfig.yaml and renders it in the shell prompt. This can leak internal infrastructure hostnames through screenshots, screen sharing, or recorded terminal sessions. The file includes a SECURITY NOTE acknowledging the risk, but the segment is enabled by default whenever the drconfig file exists.
- Recommendation: Make the segment opt-in via a chezmoi data flag (e.g.,
{{ if .work }}...{{ end }} or a dedicated starship.showDrConfig flag), or add a quick toggle command the user can run before screen sharing. If it must remain always-on, consider masking the hostname more aggressively (e.g., show only the first subdomain segment or a hash).
Automated full-codebase security review
Workflow run: https://github.com/ahjota/dotfiles/actions/runs/34365815325
Session: 9b80a8f9-5b60-4cb5-8934-ab5be27bb0b2
Summary
The full-codebase review found one low-severity information-disclosure issue in the Starship prompt configuration. No shell-injection vectors, unquoted variable expansions, hardcoded secrets, unsafe
curl | shpatterns, or chezmoi template evaluation risks with a realistic exploit path were identified. CI downloads are pinned and SHA-256 verified, GitHub Actions use minimal scoped permissions, and work-only credential handling is properly gated.Findings
1. Starship prompt renders DataRobot endpoint hostname (information disclosure)
private_dot_config/starship.toml.tmpl(lines 85–99)custom.drconfigsegment extracts the DataRobot endpoint from~/.config/datarobot/drconfig.yamland renders it in the shell prompt. This can leak internal infrastructure hostnames through screenshots, screen sharing, or recorded terminal sessions. The file includes aSECURITY NOTEacknowledging the risk, but the segment is enabled by default whenever the drconfig file exists.{{ if .work }}...{{ end }}or a dedicatedstarship.showDrConfigflag), or add a quick toggle command the user can run before screen sharing. If it must remain always-on, consider masking the hostname more aggressively (e.g., show only the first subdomain segment or a hash).