transceiver-db

rene.fichtmueller/transceiver-db

Fork 0

Commit Graph

Author	SHA1	Message	Date
Rene Fichtmueller	86d1531d52	fix(security): scrub hardcoded DB credentials, untrack training data, add scan allowlist - Replace plaintext tip (transceiver_db) and llm_gateway DB passwords with env-var references guarded by fail-fast checks, across 15 scripts + sql runbook. Covers quoted exports, unquoted psql calls, python env dicts and env-or-hardcoded-default fallbacks. - Untrack training-data/.jsonl (~48MB, kept on disk) and gitignore .jsonl. - Add .security-scan-allowlist for legit false positives: vendor name flexoptix, own homelab infra, sibling-project codenames in the sync journal, env-resolved DB URIs, example placeholders, ML tokenizer tokens. - Pre-push leak scanner goes from 397 to 0 findings, green without --no-verify. Follow-up (not in this commit): rotate the leaked values (llm_gateway first, tip fleet-wide coordinated); git history still holds the old passwords.	2026-07-07 12:06:07 +02:00
Rene Fichtmueller	d1d23ce31d	feat(v0.2.1): data confidence tracking + validation + blog feedback system - Migration 016: data_confidence column (vendor_verified/enriched_estimated/scraped_unverified) - Migration 015: blog_feedback table with 8 quality scores + free text - Validation script: 8 physics-based rules (wavelength↔fiber, reach plausibility, power limits) - Blog feedback API: POST /api/blog/:id/feedback + training data export - FO Blog Pipeline v3: 10-step Flexoptix Style prompts (Less bullshit. More engineering.) - Auto-fix: wavelength↔fiber mismatches corrected automatically	2026-03-31 09:12:37 +02:00

Author

SHA1

Message

Date

Rene Fichtmueller

86d1531d52

fix(security): scrub hardcoded DB credentials, untrack training data, add scan allowlist

- Replace plaintext tip (transceiver_db) and llm_gateway DB passwords with
  env-var references guarded by fail-fast checks, across 15 scripts + sql runbook.
  Covers quoted exports, unquoted psql calls, python env dicts and
  env-or-hardcoded-default fallbacks.
- Untrack training-data/*.jsonl (~48MB, kept on disk) and gitignore *.jsonl.
- Add .security-scan-allowlist for legit false positives: vendor name flexoptix,
  own homelab infra, sibling-project codenames in the sync journal, env-resolved
  DB URIs, example placeholders, ML tokenizer tokens.
- Pre-push leak scanner goes from 397 to 0 findings, green without --no-verify.

Follow-up (not in this commit): rotate the leaked values (llm_gateway first,
tip fleet-wide coordinated); git history still holds the old passwords.

2026-07-07 12:06:07 +02:00

Rene Fichtmueller

d1d23ce31d

feat(v0.2.1): data confidence tracking + validation + blog feedback system

- Migration 016: data_confidence column (vendor_verified/enriched_estimated/scraped_unverified)
- Migration 015: blog_feedback table with 8 quality scores + free text
- Validation script: 8 physics-based rules (wavelength↔fiber, reach plausibility, power limits)
- Blog feedback API: POST /api/blog/:id/feedback + training data export
- FO Blog Pipeline v3: 10-step Flexoptix Style prompts (Less bullshit. More engineering.)
- Auto-fix: wavelength↔fiber mismatches corrected automatically

2026-03-31 09:12:37 +02:00

2 Commits