From 53150b2ec2d01d48e71bc6bfcbce590377804b77 Mon Sep 17 00:00:00 2001 From: "kuma.jung" Date: Tue, 16 Jun 2026 14:14:47 +0900 Subject: [PATCH] Reduce accidental local secret leakage Ignore local runtime and keyserver state files that may contain command logs, token hashes, or operational metadata, and document a lightweight pre-commit secret hygiene check for contributors. Constraint: Keep this issue scoped to repository hygiene without adding new tooling or dependencies. Rejected: Add a CI secret scanner in this PR | would expand the change beyond the lowest-risk first issue. Confidence: high Scope-risk: narrow Directive: Keep local runtime directories and keyserver state out of version control unless they are sanitized fixtures. Tested: Reviewed git diff for .gitignore and CONTRIBUTING.md. Not-tested: go test ./... blocked by local Go toolchain mismatch: stdlib reports go1.25.0 while tool reports go1.25.6. --- .gitignore | 8 ++++++++ CONTRIBUTING.md | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/.gitignore b/.gitignore index c045736..924df36 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,11 @@ dist/* /ende .DS_* + +# Local agent/runtime state may contain command logs or pasted context. +.codex/ +.omx/ + +# Local keyserver state can include token hashes and operational metadata. +.ende-keyserver.json +*.ende-keyserver.json diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7d16f93..f7b8d52 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -34,3 +34,9 @@ If your change affects crypto, key handling, or trust decisions, include: - threat model impact, - migration/compatibility considerations, - validation strategy (tests/manual steps). + +## Secret hygiene +Before committing, run `git status --short` and check that local runtime +directories, keyserver state files, environment files, and command logs are not +staged. Do not commit credentials, publish tokens, private keys, or files that +record local agent sessions.