chore(security): stop tracking generated secrets - #26
Open
ctavolazzi wants to merge 1 commit into
Open
Conversation
Four credential files were committed to this public repository. All four are regenerated on demand by the code that reads them, so none of them ever needed to be tracked. .env Pexels + Pixabay API keys .waft_api_token API bearer token _pyrite/.waft/.pyrite_secret_key Fernet key _realms/.../crystallized_state/.hmac_key HMAC integrity key Regeneration points: src/waft/api/auth.py get_or_create_token() src/waft/pyrite.py _generate_secret_key() core/dnd_scenario/realm_state_preserver.py _generate_hmac_key() .waft_api_token is the most serious of the four: it is the HTTPBearer credential for the WAFT API, so anyone with a clone held a valid token for an instance running from that checkout. Removed with `git rm --cached`, so all four remain on disk. .gitignore now covers each one; verified with `git check-ignore -v`. This stops the bleeding going forward. It does NOT invalidate values already published, so the Pexels and Pixabay keys still require rotation and .waft_api_token should be deleted locally to force a fresh token. The two crypto keys must be KEPT locally: deleting .pyrite_secret_key orphans existing encrypted secrets, and deleting .hmac_key invalidates existing crystallized realm state. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four credential files were tracked in this public repository. All four are regenerated on demand by the code that reads them, so none needed to be tracked.
.env.waft_api_tokenapi/auth.py→get_or_create_token()_pyrite/.waft/.pyrite_secret_keypyrite.py→_generate_secret_key()_realms/.../.hmac_keyrealm_state_preserver.py→_generate_hmac_key().waft_api_tokenis the most serious: it is theHTTPBearercredential for the WAFT API, so anyone with a clone held a valid token for an instance running from that checkout.Removed with
git rm --cached, so all four stay on disk..gitignorenow covers each; verified withgit check-ignore -vrather than assumed.Not removed (false positives)
_realms/teleport_massive_writer/orchestration/secrets.mdis a story bible._pantheon/the_dealer/truth/keys.jsonis game state. Both matched on filename only.Follow-up required — this PR does not un-publish anything
.waft_api_tokenlocally to force a fresh token.pyrite_secret_keylocally — deleting orphans existing encrypted secrets.hmac_keylocally — deleting invalidates existing crystallized realm state🤖 Generated with Claude Code