fix(security): remove exposed RPC credentials and operator-specific paths

.env.example

@@ -0,0 +1,7 @@
+# Copy this file to .env and provide values for the scripts you intend to run.
+# .env is ignored by Git. RPC providers other than Helius are supported.
+PERCOLATOR_RPC_URL=https://your-rpc-provider.example
+
+# Required by administrative scripts. Use an absolute path to the appropriate
+# deploy-authority keypair; never commit the keypair or its contents.
+PERCOLATOR_ADMIN_KEYPAIR=/absolute/path/to/deploy-authority.json

.github/workflows/ci.yml

@@ -6,7 +6,42 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Required to inspect every commit introduced by a push or pull request.
+          fetch-depth: 0
+      - name: Scan each newly introduced commit for secrets
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          range="${BASE_SHA}..${HEAD_SHA}"
+          scan_dir="$(mktemp -d)"
+          trap 'rm -rf "$scan_dir"' EXIT
+
+          for commit in $(git rev-list --reverse "$range"); do
+            find "$scan_dir" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
+            git archive "$commit" | tar -x -C "$scan_dir"
+            docker run --rm \
+              -v "$scan_dir:/repo" \
+              zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
+              dir /repo --redact --no-banner --max-archive-depth=1
+          done
+      - name: Scan the current tree for secrets
+        run: >-
+          docker run --rm
+          -v "$GITHUB_WORKSPACE:/repo"
+          zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f
+          dir /repo --redact --no-banner --max-archive-depth=1
+
   build-and-test:
     runs-on: ubuntu-latest
     steps:
@@ -24,7 +59,7 @@ jobs:
       - run: pnpm test
 
   publish:
-    needs: build-and-test
+    needs: [secret-scan, build-and-test]
     if: github.ref == 'refs/heads/main' && startsWith(github.event.head_commit.message, 'release:')
     runs-on: ubuntu-latest
     permissions:

.gitignore

@@ -3,8 +3,11 @@ node_modules/
 package-lock.json
 .env
 .env.*
+!.env.example
 
 # Private keys, certificates, and credentials
+# These patterns match secret-bearing files only. They do not detect
+# credentials embedded in source code; use environment variables instead.
 *.pem
 *.key
 *.p12

CHANGELOG.md

@@ -799,10 +799,10 @@ last_market_slot, etc.; removed last_crank_slot and gc_cursor).
 
 - `buildLayoutV12_19` now uses V12_19-specific engine field offsets
   derived by walking the v12.19 RiskEngine struct definition at
-  `/Users/khubair/perc-sync/work/percolator/src/percolator.rs:581`,
+  `/path/to/perc-sync/work/percolator/src/percolator.rs:581`,
   cross-checked against probe constants in
-  `/Users/khubair/perc-sync/work/percolator-prog/tests/test_conservation.rs:4574,4586`
-  and `/Users/khubair/perc-sync/work/percolator-prog/tests/common/mod.rs:2185`:
+  `/path/to/perc-sync/work/percolator-prog/tests/test_conservation.rs:4574,4586`
+  and `/path/to/perc-sync/work/percolator-prog/tests/common/mod.rs:2185`:
   - `c_tot` at engine+328 (was 336 in v2.0.0).
   - `pnl_pos_tot` at engine+344 (was 352).
   - `oi_eff_long/short` at engine+488/504 (was 504/520).

audit-2026-04-27-verify/DRIFT_REPORT.md

@@ -1,9 +1,9 @@
 # Drift Report — independent verification 2026-04-27
 
-SDK at /Users/khubair/percolator-sdk @ sync/v12.19-sdk (HEAD ~911e879).
+SDK at /path/to/percolator-sdk @ sync/v12.19-sdk (HEAD ~911e879).
 Wrapper v12.17 at /tmp/wrapper-v12.17 @ 06f86fb (mainnet pin, dated
 2026-04-22).
-Wrapper v12.19 at /Users/khubair/perc-sync/work/percolator-prog @ d760fc4.
+Wrapper v12.19 at /path/to/perc-sync/work/percolator-prog @ d760fc4.
 
 ## BLOCKING (10 findings)
 

audit-2026-04-27-verify/FINAL.md

@@ -1,11 +1,11 @@
 # Independent drift verification — FINAL
 
 Date: 2026-04-27.
-SDK: /Users/khubair/percolator-sdk @ sync/v12.19-sdk (HEAD ~911e879). READ-ONLY throughout.
+SDK: /path/to/percolator-sdk @ sync/v12.19-sdk (HEAD ~911e879). READ-ONLY throughout.
 Wrapper v12.17 mainnet pin: 06f86fb (worktree at /tmp/wrapper-v12.17, removed in cleanup).
-Wrapper v12.19: d760fc4 at /Users/khubair/perc-sync/work/percolator-prog.
+Wrapper v12.19: d760fc4 at /path/to/perc-sync/work/percolator-prog.
 Engine v12.17: 3f55f87 (worktree at /tmp/engine-v12.17, removed).
-Engine v12.19: c32bc0b at /Users/khubair/perc-sync/work/percolator.
+Engine v12.19: c32bc0b at /path/to/perc-sync/work/percolator.
 
 ## Verdict
 

audit-2026-04-27-verify/error-audit.md

@@ -3,7 +3,7 @@
 SDK src/abi/errors.ts has `PERCOLATOR_ERRORS: Record<number, ErrorInfo>` — a
 hardcoded numeric → name+hint map covering 69 entries.
 
-Wrapper enum at /Users/khubair/perc-sync/work/percolator-prog/src/percolator.rs:1370
+Wrapper enum at /path/to/perc-sync/work/percolator-prog/src/percolator.rs:1370
 auto-numbers from 0 in declaration order. v12.17 wrapper at
 /tmp/wrapper-v12.17 should have a similar enum (sample-checked: same first 28).
 

audit-2026-04-27-verify/ix-tag-drift.md

@@ -2,9 +2,9 @@
 
 Source-of-truth wrappers:
 - v12.17 (mainnet pin): /tmp/wrapper-v12.17 @ 06f86fb (commit dated 2026-04-22).
-- v12.19: /Users/khubair/perc-sync/work/percolator-prog @ d760fc4.
+- v12.19: /path/to/perc-sync/work/percolator-prog @ d760fc4.
 
-SDK: /Users/khubair/percolator-sdk/src/abi/instructions.ts:17.
+SDK: /path/to/percolator-sdk/src/abi/instructions.ts:17.
 
 ## Per-tag verification table
 

audit-2026-04-27-verify/parser-audit.md

@@ -36,7 +36,7 @@ post-update; SDK parseConfig may not surface it as a field.
 
 ASSUMED-VERIFIED for v12.17 read paths. Not exhaustively walked. A
 follow-up phase would byte-by-byte compare SDK reads against
-`/Users/khubair/perc-sync/work/percolator/src/state.rs` MarketConfig
+`/path/to/perc-sync/work/percolator/src/state.rs` MarketConfig
 field offsets.
 
 ## parseEngine (src/solana/slab.ts:2832)

audit-2026-04-27-verify/pda-audit.md

@@ -32,7 +32,7 @@
 **SDK uses `b"ins_lp"` but the live LP vault mint PDA in v12.19 wrapper
 uses `b"lp_vault_mint"`.**
 
-Evidence at /Users/khubair/perc-sync/work/percolator-prog/src/percolator.rs:
+Evidence at /path/to/perc-sync/work/percolator-prog/src/percolator.rs:
 the call `crate::insurance_lp::create_mint(...)` is invoked with
 `mint_seeds: &[&[u8]] = &[b"lp_vault_mint", a_slab.key.as_ref(), &[mint_bump]]`
 (seen in the create_mint callsite around the LP vault setup).

audit-2026-04-27-verify/phase-0-checkouts.md

@@ -2,10 +2,10 @@
 
 | repo | path | commit |
 |:---|:---|:---|
-| sdk | /Users/khubair/percolator-sdk | branch `sync/v12.19-sdk` HEAD `911e879` |
-| wrapper v12.19 | /Users/khubair/perc-sync/work/percolator-prog | `d760fc4529ede4b001ce473a2d5fffc23d14167d` |
+| sdk | /path/to/percolator-sdk | branch `sync/v12.19-sdk` HEAD `911e879` |
+| wrapper v12.19 | /path/to/perc-sync/work/percolator-prog | `d760fc4529ede4b001ce473a2d5fffc23d14167d` |
 | wrapper v12.17 | /tmp/wrapper-v12.17 (worktree, created this session) | `06f86fb125525af81c0bfd19a295095dda102c07` |
-| engine v12.19 | /Users/khubair/perc-sync/work/percolator | `c32bc0bae11b5373a04f6cfaa930f906e3001239` |
+| engine v12.19 | /path/to/perc-sync/work/percolator | `c32bc0bae11b5373a04f6cfaa930f906e3001239` |
 | engine v12.17 | /tmp/engine-v12.17 (worktree, created this session) | `3f55f871a3aa29d7b582fc2641d2106cbac0c32e` |
 
 Worktrees will be removed in PHASE FINAL cleanup.

audit-2026-04-27/wrapper-findings.md

@@ -4,7 +4,7 @@ These are wrapper-side issues observed via the SDK audit. Per brief I cannot pus
 
 ## W-1: sdk_parity_fixtures.rs missing tag 83 UpdateAuthority
 
-**File:** /Users/khubair/perc-sync/work/percolator-prog/src/bin/sdk_parity_fixtures.rs
+**File:** /path/to/perc-sync/work/percolator-prog/src/bin/sdk_parity_fixtures.rs
 **Lines:** 5-85 (the `tags` array stops at AcceptAdmin / tag 82)
 
 The parity binary enumerates every wrapper tag. Tag 83 UpdateAuthority was added in v12.18.x (handler at src/percolator.rs:6876) but the parity binary was not updated.

audit-2026-04-28-v12.19/FINAL.md

@@ -1,7 +1,7 @@
 # FINAL — v12.19-only SDK alignment
 
 **Date:** 2026-04-28.
-**SDK:** `/Users/khubair/percolator-sdk` @ branch `sync/v12.19-sdk` HEAD `<latest>`. Tag `v2.0.0-rc.1`.
+**SDK:** `/path/to/percolator-sdk` @ branch `sync/v12.19-sdk` HEAD `<latest>`. Tag `v2.0.0-rc.1`.
 **Wrapper target:** `d760fc4` (PR #271, branch `sync/v12.19-wrapper`).
 **Engine target:** `c32bc0b` (PR #88, branch `sync/v12.19-engine`).
 
@@ -48,7 +48,7 @@ once that deployment lands.
 - **W-1 wrapper sdk_parity_fixtures.rs**: edit + commit DONE locally on
   `sync/v12.19-wrapper` (commit `28d7cbd`). Push to PR #271 + merge to main
   pending user action. Parity:check stays red until main rolls forward
-  because the SDK script runs cargo from `/Users/khubair/percolator-prog`
+  because the SDK script runs cargo from `/path/to/percolator-prog`
   (a separate checkout on main, not the perc-sync work tree). See
   `phase-4-deferred.md`.
 
@@ -93,7 +93,7 @@ once that deployment lands.
 ## Reproducibility
 
 ```
-cd /Users/khubair/percolator-sdk
+cd /path/to/percolator-sdk
 git checkout v2.0.0-rc.1
 pnpm install
 pnpm test          # 792 PASS / 31 SKIPPED

audit-2026-04-28-v12.19/phase-0-recheck.md

@@ -11,7 +11,7 @@ both still open, no flips. proceed.
 
 ## SDK state
 
-- repo: /Users/khubair/percolator-sdk
+- repo: /path/to/percolator-sdk
 - branch: sync/v12.19-sdk
 - HEAD: 911e879
 - version: 2.0.0-rc.0
@@ -66,11 +66,11 @@ instruction tag presence in `pub fn decode` at src/percolator.rs:1784 (sample):
 NO V12_19 entry. fix in PHASE 3:
 - V12_19 SLAB_LEN: 1_525_720 (per closeout)
 - V12_19 vault offset: 616 (was 600 in V12_17, +16 shift)
-- engine field offsets and BITMAP_OFF derived from engine repo at /Users/khubair/perc-sync/work/percolator @ c32bc0b state/engine.rs (or equivalent module)
+- engine field offsets and BITMAP_OFF derived from engine repo at /path/to/perc-sync/work/percolator @ c32bc0b state/engine.rs (or equivalent module)
 
 ## wrapper W-1 in PHASE 4
 
-`/Users/khubair/perc-sync/work/percolator-prog/src/bin/sdk_parity_fixtures.rs` enumerates 78 tags but stops at tag 82. missing tag 83 UpdateAuthority. fix is a single line addition in PHASE 4.
+`/path/to/perc-sync/work/percolator-prog/src/bin/sdk_parity_fixtures.rs` enumerates 78 tags but stops at tag 82. missing tag 83 UpdateAuthority. fix is a single line addition in PHASE 4.
 
 ## removed encoders worth confirming stay removed
 

audit-2026-04-28-v12.19/phase-4-deferred.md

@@ -14,7 +14,7 @@ What remains is pushing it and waiting for PR #271 to merge to main.
 
 ## Why parity:check still reads red
 
-The SDK's `scripts/check-parity-fixtures.mjs` runs `cargo run --bin sdk_parity_fixtures` from `resolve(sdkRoot, "..", "percolator-prog")` which is `/Users/khubair/percolator-prog`. That checkout is on `main` at `f1d63ef`, 198 commits behind the v12.19 PR head and missing the `TAG_UPDATE_AUTHORITY` constant entirely. So the SDK spec is ahead of what main can produce.
+The SDK's `scripts/check-parity-fixtures.mjs` runs `cargo run --bin sdk_parity_fixtures` from `resolve(sdkRoot, "..", "percolator-prog")` which is `/path/to/percolator-prog`. That checkout is on `main` at `f1d63ef`, 198 commits behind the v12.19 PR head and missing the `TAG_UPDATE_AUTHORITY` constant entirely. So the SDK spec is ahead of what main can produce.
 
 This is structurally correct: the SDK already encodes UpdateAuthority, and the spec correctly lists it. The wrapper main needs to roll forward (by merging PR #271 which now includes commit 28d7cbd) before parity goes green.
 
@@ -23,14 +23,14 @@ This is structurally correct: the SDK already encodes UpdateAuthority, and the s
 1. Push the wrapper W-1 commit to PR #271:
 
 ```
-cd /Users/khubair/perc-sync/work/percolator-prog
+cd /path/to/perc-sync/work/percolator-prog
 git push -u origin sync/v12.19-wrapper
 ```
 
 2. After PR #271 merges to `dcccrypto/percolator-prog` main:
 
 ```
-cd /Users/khubair/percolator-prog
+cd /path/to/percolator-prog
 git pull origin main
 ```
 
@@ -39,7 +39,7 @@ Parity:check goes green automatically once main has UpdateAuthority.
 ## Verification (post-merge)
 
 ```
-cd /Users/khubair/percolator-sdk
+cd /path/to/percolator-sdk
 pnpm run parity:check   # all 4 programs OK, exit 0
 ```
 

deep-check.ts

@@ -1,12 +1,13 @@
+import { requireRpcUrl } from "./scripts/config.mjs";
 import { Connection, PublicKey } from "@solana/web3.js";
 
 const SLAB = new PublicKey("6akNPYQLyg2nGLDtGAoykB8ZtuoAEwGhxreXaDWncya2");
 const WALLET = new PublicKey("GnjCwHLm9bWdPrJ6z2frMf5kYmRh1qCb9otBEXUuSpUd");
 const PROGRAM = new PublicKey("ESa89R5Es3rJ5mnwGybVRG1GrNt9etP11Z5V2QWD4edv");
-const rpc = "https://mainnet.helius-rpc.com/?api-key=2a089bfd-18ae-48b5-abbe-36b0383ecad3";
+const RPC = requireRpcUrl();
 
 async function main() {
-  const conn = new Connection(rpc, "confirmed");
+  const conn = new Connection(RPC, "confirmed");
 
   // Get ALL transactions on the slab
   const allSigs = await conn.getSignaturesForAddress(SLAB, { limit: 50 });

full-state.ts

@@ -1,11 +1,12 @@
+import { requireRpcUrl } from "./scripts/config.mjs";
 import { fetchSlab, detectSlabLayout, parseHeader, parseConfig, parseEngine, parseAllAccounts, parseUsedIndices } from "./dist/index.js";
 import { Connection, PublicKey } from "@solana/web3.js";
 
 const SLAB = "5RfUzS1kpdhVb2CNGvE9UGdthsGbd354LoXSYjCFHv3R";
-const rpc = process.env.RPC_URL || "https://api.mainnet-beta.solana.com";
+const RPC = requireRpcUrl();
 
 async function main() {
-  const conn = new Connection(rpc);
+  const conn = new Connection(RPC);
   const buf = await fetchSlab(conn, new PublicKey(SLAB));
   const layout = detectSlabLayout(buf.length, buf);
 

scripts/bootstrap-hyperp-oracle.mjs

@@ -1,3 +1,4 @@
+import { requireAdminKeypairPath, requireRpcUrl } from "./config.mjs";
 // Bootstrap fix: send UpdateHyperpMark on its own (no Crank bundled) so the
 // new market's oracle picks up a fresh slot timestamp. After this lands,
 // the keeper's bundled UpdateHyperpMark+Crank tx should pass freshness check.
@@ -6,19 +7,17 @@ import {
   Connection, Keypair, PublicKey, Transaction, TransactionInstruction,
   sendAndConfirmTransaction, ComputeBudgetProgram, SYSVAR_CLOCK_PUBKEY,
 } from '@solana/web3.js';
-import { encodeUpdateHyperpMark } from '/Users/khubair/percolator-sdk/dist/index.js';
+import { encodeUpdateHyperpMark } from '../dist/index.js';
 import fs from 'fs';
-import os from 'os';
-import path from 'path';
 
-const RPC = 'https://api.mainnet-beta.solana.com';
+const RPC = requireRpcUrl();
 const PROGRAM_ID = new PublicKey('ESa89R5Es3rJ5mnwGybVRG1GrNt9etP11Z5V2QWD4edv');
 const SLAB = new PublicKey('H7CVBttJmyAiae3bsKSCz8DbrPtKwMhs4NeFmQ9okhpz');
 const POOL = new PublicKey('3ucNos4NbumPLZNWztqGHNFFgkHeRMBQAVemeeomsUxv');
-const ADMIN_KEY = path.join(os.homedir(), '.percolator-mainnet', 'keys', 'deploy-authority.json');
+const ADMIN_KEYPAIR_PATH = requireAdminKeypairPath();
 
 const conn = new Connection(RPC, 'confirmed');
-const admin = Keypair.fromSecretKey(new Uint8Array(JSON.parse(fs.readFileSync(ADMIN_KEY, 'utf8'))));
+const admin = Keypair.fromSecretKey(new Uint8Array(JSON.parse(fs.readFileSync(ADMIN_KEYPAIR_PATH, 'utf8'))));
 
 console.log('Sending solo UpdateHyperpMark...');
 

scripts/check-slab.mjs

@@ -1,7 +1,8 @@
+import { requireRpcUrl } from "./config.mjs";
 import { Connection, PublicKey } from '@solana/web3.js';
-import { parseConfig, parseHeader } from '/Users/khubair/percolator-sdk/dist/index.js';
+import { parseConfig, parseHeader } from '../dist/index.js';
 
-const conn = new Connection('https://api.mainnet-beta.solana.com', 'confirmed');
+const conn = new Connection(requireRpcUrl(), 'confirmed');
 const SLAB = new PublicKey('H7CVBttJmyAiae3bsKSCz8DbrPtKwMhs4NeFmQ9okhpz');
 const info = await conn.getAccountInfo(SLAB);
 const data = new Uint8Array(info.data);

scripts/close-market-v3.ts

@@ -1,3 +1,4 @@
+import { requireAdminKeypairPath, requireRpcUrl } from "./config.mjs";
 /**
  * close-market-v3.ts
  *
@@ -6,7 +7,6 @@
  *
  * Flow: ResolveMarket -> CloseAccount(idx=0) -> WithdrawInsurance -> CloseSlab
  */
-import 'dotenv/config';
 import {
   Connection,
   Keypair,
@@ -22,13 +22,15 @@ import { encodeCloseAccount, encodeWithdrawInsurance, encodeCloseSlab } from '..
 import { buildAccountMetas, ACCOUNTS_WITHDRAW_INSURANCE } from '../src/abi/accounts.js';
 import { buildIx } from '../src/runtime/tx.js';
 import { parseConfig, parseEngine, parseHeader, parseUsedIndices } from '../src/solana/slab.js';
-import { deriveVaultAuthority, deriveKeeperFund } from '../src/solana/pda.js';
+import { deriveVaultAuthority } from '../src/solana/pda.js';
+import { deriveKeeperFund } from './pda.mjs';
 import fs from 'fs';
 
-const HELIUS_RPC = 'https://mainnet.helius-rpc.com/?api-key=ecfc91c7-b704-4c37-b10e-a277392830aa';
-const conn = new Connection(HELIUS_RPC, 'confirmed');
+const RPC = requireRpcUrl();
+const ADMIN_KEYPAIR_PATH = requireAdminKeypairPath();
+const conn = new Connection(RPC, 'confirmed');
 const admin = Keypair.fromSecretKey(
-  Buffer.from(JSON.parse(fs.readFileSync('/Users/khubair/.percolator-mainnet/keys/deploy-authority.json', 'utf8')))
+  Buffer.from(JSON.parse(fs.readFileSync(ADMIN_KEYPAIR_PATH, 'utf8')))
 );
 const PROGRAM_ID = new PublicKey('ESa89R5Es3rJ5mnwGybVRG1GrNt9etP11Z5V2QWD4edv');
 const SLAB = new PublicKey('12o3bXwBm9TxrMboFwNN2C9nzCuuCkwBthrjV2NQobQd');

scripts/config.mjs

@@ -0,0 +1,17 @@
+import "dotenv/config";
+
+export function requireEnvironmentVariable(name, environment = process.env) {
+  const value = environment[name]?.trim();
+  if (!value) {
+    throw new Error(`${name} is not set.`);
+  }
+  return value;
+}
+
+export function requireRpcUrl(environment = process.env) {
+  return requireEnvironmentVariable("PERCOLATOR_RPC_URL", environment);
+}
+
+export function requireAdminKeypairPath(environment = process.env) {
+  return requireEnvironmentVariable("PERCOLATOR_ADMIN_KEYPAIR", environment);
+}

scripts/diag-slab.ts

@@ -1,9 +1,9 @@
-import 'dotenv/config';
+import { requireRpcUrl } from "./config.mjs";
 import { Connection, PublicKey } from '@solana/web3.js';
 import { parseEngine, parseHeader } from '../src/solana/slab.js';
 
 async function main() {
-  const conn = new Connection('https://mainnet.helius-rpc.com/?api-key=ecfc91c7-b704-4c37-b10e-a277392830aa', 'confirmed');
+  const conn = new Connection(requireRpcUrl(), 'confirmed');
   const SLAB = new PublicKey('F8BbnGhUV14Chr5NtGMhM9cGMCANrtsQwBmGN96S8PV8');
   const info = await conn.getAccountInfo(SLAB);
   if (!info) throw new Error('Slab not found');