Remove committed secrets; enforce env vars + gitleaks pre-commit/CI gates - #930
Open
devin-ai-integration[bot] wants to merge 3 commits into
Open
devin-ai-integration[bot] wants to merge 3 commits into
devin-ai-integration[bot] wants to merge 3 commits into
Conversation
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Weekly gitleaks sweep found live secrets committed on main (values redacted):
.github/workflows/deploy.yml:15-16— AWS access key ID + secret (AKIA****/****).github/workflows/deploy.yml:23— Slack bot token (xoxb-****).github/workflows/deploy.yml:29— GitHub PAT (ghp_****).github/workflows/deploy.yml:35— Stripe live key (sk_live_****)backend/src/config/production.js:14— hardcoded JWT secret (****), plus Postgres URL with password and SendGrid keyfrontend/.env— tracked env file (only non-secretVITE_API_URL; removed anyway)Remediation (same approach as PRs #862/#865/#870/#902/#909/#923):
deploy.ymlnow uses${{ secrets.* }}references instead of literals.production.jsreads config viarequireEnv(name)which throws when the env var is missing — no fallback literals..gitignore: ignore.env/*.env(allow*.env.example);frontend/.envuntracked and removed..pre-commit-config.yaml: gitleaks hook (pinned rev)..github/workflows/gitleaks.yml: CI gate on push/PR running the gitleaks CLI (--no-gitworking-tree scan; history still contains leaks until purged), checkout pinned to SHA, HTTPS-enforced download.Post-fix working-tree scan: no leaks. Backend tests (161) pass; frontend lint clean.
Rotation required
All leaked credentials (AWS, Slack, GitHub PAT, Stripe, JWT secret, Postgres password, SendGrid) must be treated as compromised and rotated — git history still contains them. History purging should be done separately.
Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/a9ed8ff8c04949e29c34812655543ebc
Open in Devin Desktop: https://partner-workshops.devinenterprise.com/desktop/session/a9ed8ff8c04949e29c34812655543ebc?variant=devin