Correct the secrets job comment about the history finding - #9
Merged
Conversation
The comment described the Web3Forms access key in this repository's history as already rotated. It was not rotated. The key remains live and its continued exposure is a deliberately accepted risk, on the basis that Web3Forms treats the value as the form's own identifier and publishes it to the browser by design. The same claim was corrected in .env.example and SECURITY.md; this file was missed at the time and is the last place stating it.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The comment explaining why the
secretsjob does not scan full historydescribed the Web3Forms access key in this repository's history as
"already rotated". It was not rotated, and it is not going to be.
The key remains live. Its continued exposure is a deliberately accepted
risk, on the basis that Web3Forms treats the value as the form's own
identifier and publishes it to the browser by design, so the exposure
carries no account access and no confidentiality loss beyond what the
deployed site already discloses.
That distinction matters here more than in an ordinary stale comment.
The comment sits in a public file and is the stated justification for
the job's scope, so a reader auditing the repository would take it as
evidence the finding is closed. The accepted-risk position is
defensible on its own terms; the claim of remediation is not.
The same claim was corrected in
.env.exampleandSECURITY.mdin anearlier change. This file was missed at the time and is the last place
stating it. The rest of the tree has been swept for the same claim and
for
revoked,invalidatedandregenerated; the only remaining hitsconcern brand asset regeneration and are unrelated.
Comment-only change. No behaviour change to either job. The workflow
still parses to the same two jobs,
verifyandsecrets, with thesame three steps in
secrets.Generated by Claude Code