Repository navigation
Prevent scrubbed phones, machine paths, and mislabeled Solana keys from returning - #10
Merged
Merged
Conversation
Add gitleaks rules, a GitHub Action, and a pre-commit hook so the 948-area Signal number family, developer machine paths, and mislabeled SOLANA_PRIVATE_KEY samples cannot land on main again. The public receive address stays allowlisted only on existing payment and treasury surfaces. Co-authored-by: NullAI <NullAITech@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The history scrub removed a hardcoded Signal number,
/home/zoth, a disk UUID, and an EnvGuard sample that labeled the public receive address asSOLANA_PRIVATE_KEY. This PR adds scanner rules so that material cannot land onmainagain. No product code changes.What fails the scan
1forms. Reserved+1-555-555-0199fixtures and obvious dummy runs stay allowed. ASIGNAL_ACCOUNTor signal recipient set to any other real NANP number also fails./home/zothand/media/neo/./dev/disk/by-uuid/,/dev/disk/by-partuuid/,/dev/disk/by-id/hardware serials, and the scrubbed disk UUID prefix.SOLANA_PRIVATE_KEY=when the value is high-entropy base58 (an address or a keypair). AnySOLANA_PRIVATE_KEYinside an EnvGuard file, a sample-env file, or aSAMPLE_ENVassignment fails even when the value is aDemofake. Fixtures must useSOLANA_ADDRESSandYOUR_*placeholders.Public receive address
GG2eQbVh8ut1BK6j1A2tz7pSySdLpD38BgyEhGcxdXoKis allowlisted only on the existing labeled payment and treasury surfaces: Agora, the DePay funnel, the publicsolanaWalletcatalog, the public llms checkout copy, and the tool pages that copy that same receiver. The comment in.gitleaks.tomlrecords why. Assigning that address toSOLANA_PRIVATE_KEYstill fails.CI
.github/workflows/gitleaks.ymlruns on every pull request and every push, includingmain.gitleaks/gitleaks-action@v3(v2 cannot run on current GitHub-hosted runners) with gitleaks 8.30.1 and.gitleaks.toml. Findings fail the job.GITLEAKS_LICENSEsecret is set (https://gitleaks.io). The workflow still fails on findings without that secret: the same v8.30.1 binary scans the tree directly, including on fork pull requests. When the secret is present, a failing action fails the job as well (pull-request comments and the commit-range scan)..pre-commit-config.yamlpins the same gitleaks version for local commits.Policy and local commands:
docs/SECRET-HYGIENE.md.Verification
actionlint1.7.7 reports no issues in the workflow.gitleaks dir(v8.30.1,.gitleaks.toml) on this tip reports no leaks.gitleaks git --log-opts="-1"on this commit reports no leaks.+1-555-555-0199,#0d9488,SOLANA_ADDRESS=Demo…, and the current tree.