fix(security): remove exposed RPC credentials and operator-specific paths

[Bayyan16]

Summary

• Removes hard-coded provider credentials from the affected scripts/ entry points and the root-level deep-check.ts diagnostic.
• Replaces machine-specific RPC, deploy-authority keypair, and SDK import paths with explicit portable configuration and repository-relative imports.
• Adds whole-repository, archive-aware leak prevention without requiring secrets or write permissions on fork pull requests.
• Removes a stale tracked package archive whose embedded source map retained an operator path.

Background

This addresses the code-remediation portion of #369 and incorporates the expanded scope identified in the first issue comment:

• a second, different exposed credential existed in root-level deep-check.ts;
• detection therefore covers the whole tracked tree, not only scripts/;
• operator paths were present in executable scripts, source, generated source maps, changelog/audit records, and a tracked package archive;
• source-map sourcesContent made the path part of packaged output.

Both exposed credentials must still be treated as compromised. This PR removes them from the current tree; it does not rotate them or erase historical copies.

Changes

• Added scripts/config.mjs with fail-fast validation for PERCOLATOR_RPC_URL and PERCOLATOR_ADMIN_KEYPAIR, using the existing dotenv dependency.
• Updated 26 root/script mainnet diagnostics and operational entry points to require an explicit RPC URL, including deep-check.ts and full-state.ts; no public-mainnet fallback remains in those entry points.
• Updated 11 administrative scripts to validate the admin keypair path before constructing a connection or reading a file.
• Replaced seven machine-absolute SDK imports with ../dist/index.js and restored the scripts' removed keeper-fund derivation as a script-local helper without changing the SDK API.
• Replaced operator-specific paths in source, changelog, and audit records with portable placeholders while preserving repository/file context.
• Rebuilt tracked dist/; the source-map path is removed. The build also materializes pre-existing generated drift from current source in dist/index.js and dist/solana/stake.d.ts.
• Removed the stale tracked percolatorct-sdk-4.3.0.tgz, whose embedded source map retained the operator path. Current package dry-run output remains dist/-only.
• Added .env.example, a precise .gitignore exception, and clarification that filename ignores do not detect inline credentials.
• Added a least-privilege CI job using Gitleaks v8.30.1 pinned by image digest. It scans the checked-out current tree plus one archive level with redacted output, requires no token or repository secret, and avoids permanently failing on the known leaked base history.
• Added focused configuration helper tests and included them in the repository's explicit Vitest list.

Security Properties

• No embedded provider credential remains in the current tracked tree.
• No silent credential-bearing or public-mainnet fallback remains in the remediated operational diagnostics.
• Missing RPC and administrative keypair configuration fails before network requests or keypair filesystem reads.
• No operator-specific home path or absolute developer-local SDK import remains in current tracked/generated content.
• CI detects future current-tree leaks across the repository, including secrets inside one level of tracked archives.
• Configured RPC URLs are not logged.

This does not claim that historical copies have been erased or that either credential has been rotated.

Validation

Validated with Node.js v20.20.2 and pnpm 9.15.9 (the downloaded Node archive matched the published SHA-256):

• pnpm install --frozen-lockfile — passed; lockfile was up to date, 152 packages installed, 2.3s.
• pnpm lint — passed.
• pnpm build — passed; dist/index.js and source map regenerated successfully.
• pnpm test — passed. Vitest phase: 30 files passed; 1012 tests passed, 31 skipped (1043 total). All preceding direct tsx test stages also passed.
• Missing-RPC execution checks — 26/26 affected entry points linked and failed with PERCOLATOR_RPC_URL is not set. before side effects.
• Missing-admin execution checks — 11/11 administrative entry points failed with PERCOLATOR_ADMIN_KEYPAIR is not set. before connection construction or filesystem reads.
• Targeted ESM static compilation — 26/26 modified entry points compiled successfully.
• Gitleaks v8.30.1, pinned image digest, dir scan with redaction and --max-archive-depth=1 — passed; approximately 4.19 MB scanned, no leaks found.
• Generic tracked-tree scans — no credential-bearing provider URL, operator home path, os.homedir() assumption, absolute developer import, private-key marker, bearer token, or tracked private .env file found.
• actionlint v1.7.12 (release archive checksum verified) — passed with exit 0.
• npm pack --dry-run --json — passed; 34 files, expected dist/ present, no .env, script, diagnostic, audit, or private configuration file included.
• git diff --check origin/main...HEAD — passed.
• git merge-tree --write-tree origin/main HEAD — passed with no conflict.

The following repository checks require external sibling-repository artifacts and fail identically on origin/main at 3704dfda7118f988a83459f18f999d177e7bc90f:

• pnpm verify-layout — percolator-prog/target/layout.json is absent.
• pnpm parity:check — expected sibling Rust parity binaries/state are absent and the matcher fixture already drifts.

Neither failure is caused by this PR, and no ABI/layout/spec source is changed here.

Operational Follow-up Required

• Rotate/revoke the first exposed Helius credential.
• Rotate/revoke the second exposed Helius credential.
• Review Helius usage, billing, quota, and access logs.
• Coordinate removal from affected Git history, branches, and tags.
• Notify maintainers and fork/clone holders about retained historical copies.
• Verify releases, caches, artifacts, and mirrors.
• Confirm provider-side rotation independently.

Risk and Compatibility

• No SDK public API or ABI source change is introduced.
• Operational scripts now require explicit PERCOLATOR_RPC_URL; administrative scripts additionally require PERCOLATOR_ADMIN_KEYPAIR.
• No runtime dependency or lockfile change is introduced; the existing dotenv development dependency is reused.
• Generated artifacts changed because repository policy requires rebuilding tracked dist/ after source changes; this removes the source-map path and synchronizes already-drifted generated output with current source.
• The secret scan runs on a clean checked-out working tree rather than historical commits, so known base-history leaks do not make every PR fail. It uses read-only workflow permissions, no write permission, no token, and no repository secret, so fork pull requests remain supported.
• Open PR fix(abi): NFT_PROGRAM_ID pointed at a program that is not deployed on devnet #372 overlaps only generated dist outputs; if it lands first, dist should be regenerated after rebasing rather than resolved mechanically.

Issue Link

Addresses #369

The issue should remain open until authorized maintainers confirm provider-side rotation and decide/complete the appropriate history and artifact remediation.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b2ea4f4f-a9aa-4514-bd05-fa2cf88da0ed

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 78ac0fc5c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make publishing depend on the secret scan

On a release: push, this new job runs independently while publish still has only needs: build-and-test; therefore the npm publish can start—and succeed—even when secret-scan has failed or is still running. This defeats the protection precisely for a release commit containing a credential in the package, so publish should depend on both jobs.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Scan Git history rather than only the checkout tree

This invokes Gitleaks' dir command, which scans files/directories rather than Git history (upstream command documentation); combined with the default shallow checkout, a PR can expose a secret in one commit, delete it before the tip, and pass this job even though the credential remains retrievable from the repository. The credentials removed by this commit are likewise still present in its parent, so use a history-capable gitleaks git scan with sufficient checkout depth (and rotate any already-exposed credentials).

Useful? React with 👍 / 👎.