scripts/history-secret-scan.baseline
Rama master · réplica de lectura del repositorio original.
# Reviewed history findings for scripts/history-secret-scan.mjs (SEC-05, 2026-10-23).
#
# Format: <rule> <path> <fingerprint|-> [reason]
#
# <fingerprint> first 12 hex of SHA-256(secret). Safe only for a HIGH-ENTROPY value:
# an 8-character key or an email address can be recovered from a hash,
# so those use `-` instead.
# - any value of this rule at this path. Costs path-level precision; it is
# the last resort, and the reason has to say why a hash would disclose
# the value. A reviewer must be able to act on every `-` entry.
#
# Everything here was read and classified in HistorySecretScan.md. Nothing in this file is
# a secret: the two real findings are described, not reproduced, and their fingerprints are
# either withheld (`-`) or belong to a value long enough that a hash cannot be reversed.
# A finding that is NOT listed here fails the `history-secrets` CI job.
# ── real, removed from the tree but permanent in history ─────────────────────────────────
authorization-bearer-literal docs/DEVIN-CONNECT-CUTOVER.md - REAL: downstream gateway key (8 chars) in a curl example; redacted from the tree in 413106e, still in every clone. No fingerprint because a short lowercase key is recoverable from a 12-hex hash. Owner action: confirm the key was rotated.
openai-api-key scripts/model-identity-test.js fa682d4bfa18 REAL-LOOKING: default --api-key value for the model-identity script (37 chars, random core), removed in 14ad336 when the script started requiring an explicit key. Owner action: confirm and rotate if it was live.
# ── reviewed synthetic fixtures and placeholders ─────────────────────────────────────────
openai-api-key docs/HISTORY-LEDGER-2026-08-docs.md e2e652b2750a SYNTHETIC: ledger prose quoting the web-search-exposure test fixture.
credentialed-email-example docs/releases/RELEASE_NOTES_2.0.39.md - PII: account email addresses next to `"password":"..."`; no credential value is present. Path-scoped because addresses are guessable from a hash.
openai-api-key scripts/smoke-matrix/flows-core.mjs c453a72deed1 SYNTHETIC: smoke-matrix "wrong key" placeholder.
literal-credential-assignment scripts/smoke-matrix/flows-login.mjs 43c1fa3cc79d SYNTHETIC: smoke-matrix "definitely not the password" placeholder.
literal-credential-assignment scripts/smoke-matrix/flows-login.mjs 98e80d5d77e9 SYNTHETIC: smoke-matrix "wrong password" placeholder.
openai-api-key test/auth-warning.test.js 291ca1d29216 SYNTHETIC: pre-fix maskApiKey length-scaling fixture (readable 27-char sk-prefixed placeholder with no fixture marker); tree replaced with a self-marking fixture, old blob persists in history at f43b5b7a.
literal-credential-assignment test/dashboard-devin-read.test.js 8d116d73452c SYNTHETIC: literal placeholder token in a cache-key test.
literal-credential-assignment test/helpers/smoke-matrix-upstream.mjs 98621d83618b SYNTHETIC: smoke-matrix upstream password placeholder.
openai-api-key test/helpers/smoke-matrix-upstream.mjs 3c32a755a837 SYNTHETIC: smoke-matrix OTP key placeholder.
literal-credential-assignment test/sec2-trusted-client-credential-gates.test.js 18a0977a6e7c SYNTHETIC: "offline-password" fixture.
literal-credential-assignment test/session-reauth-route.test.js 6ca420eba3a0 SYNTHETIC: "auth1_this_is_an_intermediate_ticket_value" fixture (same value in two commits).
jwt-literal test/special-agent-credential-redaction.test.js 7c5b02291898 SYNTHETIC: the jwt.io example JWT (sub 1234567890) used to test redaction.
openai-api-key test/transport-matrix.helpers.mjs 93d6533f4255 SYNTHETIC: pre-fix transport-matrix fixture key; the tree was changed to a self-marking fixture in f1aaab56, the old blob remains in history.
openai-api-key test/web-search-exposure.test.js e2e652b2750a SYNTHETIC: key-shaped fixture for the exposure test.
credentialed-email-example tmp-testing/test-new-issues.py 06a581238272 SYNTHETIC: test@test.com with password "wrong" in a scratch script that was later gitignored.