Harden secret hygiene and add automated leakage checks by ahump20 · Pull Request #2 · Blaze-sports-Intel/college-baseball-api

Austin Humphrey (ahump20) · 2026-03-13T10:52:46Z

Motivation

Prevent server-side secrets from being committed or leaking into client builds or static output by enforcing repository-level guardrails.
Make secret scanning part of the developer workflow and CI so leaks are caught before merge or deploy.
Provide a safe, documented template for runtime env variables so developers use server-side secret bindings instead of storing values in source.

Description

Tightened ignore rules in .gitignore and added a sanitized .env.example that documents server-only variables and points to Cloudflare secret bindings.
Added scripts/secret-smoke-check.sh to scan source and common build output directories for credential-like patterns and wired a security:smoke npm script and a security:gitleaks helper in package.json.
Added a GitHub Actions workflow .github/workflows/security.yml that runs gitleaks and the smoke check on PRs and pushes, and added a pre-commit detect-secrets config plus an empty .secrets.baseline.
Documented the secret-hygiene checks in README.md so maintainers run npm run security:smoke before merging.

Testing

Ran the unit test suite with npm test (Vitest) and observed all tests pass.
Ran the repository smoke check with npm run security:smoke and it returned Secret smoke check passed.
The new CI workflow and pre-commit hooks were added to the repo for automated enforcement on PRs and local commits (CI execution pending on PRs).

Codex Task

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7773d354e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

chatgpt-codex-connector · 2026-03-13T10:55:15Z

+
+failed=0
+for pattern in "${patterns[@]}"; do
+  if rg -n -P "${pattern}" . "${exclude_globs[@]}" > /tmp/secret_scan_hits.txt; then


Include dotfiles when scanning repository for secrets

The main scan uses rg on . without --hidden, so it silently skips hidden files/directories such as .github/** and .env.example; a committed secret in those paths will pass both npm run security:smoke and the CI workflow even though they are tracked source files. I verified this behavior locally by placing an API_KEY="..." value in a hidden file (.tmpsecret), which was not reported, while the same content in a non-hidden file was detected.

Useful? React with 👍 / 👎.

Copilot

Pull request overview

Adds repo-level guardrails to prevent secret leakage by introducing automated secret scanning in local workflows and CI, plus documenting expected secret handling.

Changes:

Added a ripgrep-based secret “smoke check” script and wired it into npm scripts.
Added CI secret scanning via a new GitHub Actions workflow (Gitleaks + smoke check).
Introduced pre-commit detect-secrets configuration + baseline, updated .gitignore, and documented the process in README.md.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
scripts/secret-smoke-check.sh	New repo-wide scan targeting credential-like patterns in source and build outputs.
package.json	Adds npm scripts to run the smoke check and local gitleaks helper.
.github/workflows/security.yml	New CI workflow to run gitleaks and the smoke check on PRs/pushes.
.pre-commit-config.yaml	Adds detect-secrets pre-commit hook configuration.
.secrets.baseline	Adds detect-secrets baseline file (currently empty).
.gitignore	Ignores `.env.*` while allowing `.env.example`.
.env.example	Adds a sanitized template guiding use of Cloudflare secret bindings.
README.md	Documents the secret hygiene expectations and the smoke check command.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    if rg -n -P "sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{36}|AKIA[0-9A-Z]{16}" "$dir" > /tmp/build_secret_scan_hits.txt; then
+      echo "Potential secret token found in build output directory: $dir"
+      cat /tmp/build_secret_scan_hits.txt
+      failed=1
+    fi


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Austin Humphrey (ahump20) · 2026-05-29T23:17:11Z

Copilot resolve the merge conflicts in this pull request

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 4 comments.

+  fi
+done
+
+build_dirs=(.next out build public)


+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@c7a0bdbe0cbf82e9ef5222da9d19923ad259c1bc # v2
+        env:
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


+  "plugins_used": [
+    {


+Before merging, run:
+
+```bash
+npm run security:smoke
+```
+
+CI also runs Gitleaks plus the same smoke check on every PR.


chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 07c9bdc683

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

chatgpt-codex-connector · 2026-05-29T23:22:38Z

+  fi
+done
+
+build_dirs=(.next out build public)


Include dist outputs in build artifact scan

The smoke check explicitly rescans only .next, out, build, and public, but this repo’s TypeScript projects write build artifacts to dist under api, sync, and packages/analytics; because .gitignore ignores dist/, the earlier rg . pass will skip those directories. If a built Worker bundle or package output under api/dist contains a token, npm run security:smoke can still pass, which leaves the main artifact location unprotected.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-29T23:22:38Z

+  "sk-[A-Za-z0-9]{20,}"
+  "ghp_[A-Za-z0-9]{36}"
+  "AKIA[0-9A-Z]{16}"
+  "(?i)(api[_-]?key|secret|token)\\s*[:=]\\s*['\"][A-Za-z0-9_\\-]{12,}"


Match unquoted credential assignments

This generic assignment pattern requires the secret value to start with a quote, so common unquoted forms such as API_KEY=abcdefghijkl in shell/env-style files or api_key: abcdefghijkl in YAML are not reported by npm run security:smoke unless they also happen to match one of the hard-coded token prefixes. That leaves a straightforward false negative for credential-like assignments in non-hidden tracked files.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-29T23:22:38Z

+        env:
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Provide the required Gitleaks license secret

This repository is under the Blaze-sports-Intel organization, and the official gitleaks/gitleaks-action@v2 documentation says organization-owned repos must provide GITLEAKS_LICENSE. Since the new workflow only passes GITHUB_TOKEN, the Gitleaks step will fail before the smoke check runs unless the repository is moved to a personal account or the license secret is added to this env block.

Useful? React with 👍 / 👎.

Copilot · 2026-05-29T23:22:54Z

Copilot resolve the merge conflicts in this pull request

Merged origin/main into this PR branch and resolved the conflict in package.json by preserving both security scripts and the new hook/secrets scripts. Addressed in commit b5360a8.

Harden repo against secret leakage into source and build outputs

7773d35

Copilot AI review requested due to automatic review settings March 13, 2026 10:52

Austin Humphrey (ahump20) added the codex label Mar 13, 2026 — with ChatGPT Codex Connector

chatgpt-codex-connector Bot reviewed Mar 13, 2026

View reviewed changes

Copilot AI reviewed Mar 13, 2026

View reviewed changes

Austin Humphrey (ahump20) requested a review from Copilot May 29, 2026 23:16

Potential fix for pull request finding

20a3308

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of Austin Humphrey (ahump20) May 29, 2026 23:16 View session

Austin Humphrey (ahump20) and others added 5 commits May 29, 2026 18:16

Potential fix for pull request finding

99231ab

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

5ab1fdf

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

78b0a86

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

1ed26f1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

07c9bdc

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Austin Humphrey (ahump20) assigned Copilot May 29, 2026

Copilot AI reviewed May 29, 2026

View reviewed changes

Copilot started work on behalf of Austin Humphrey (ahump20) May 29, 2026 23:18 View session

Merge origin/main into codex/2026-03-13

b5360a8

chatgpt-codex-connector Bot reviewed May 29, 2026

View reviewed changes

Copilot finished work on behalf of Austin Humphrey (ahump20) May 29, 2026 23:23

Conversation

Austin Humphrey (ahump20) commented Mar 13, 2026

Motivation

Description

Testing

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Austin Humphrey (ahump20) commented May 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 29, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 29, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants