86d1531d52
- Replace plaintext tip (transceiver_db) and llm_gateway DB passwords with env-var references guarded by fail-fast checks, across 15 scripts + sql runbook. Covers quoted exports, unquoted psql calls, python env dicts and env-or-hardcoded-default fallbacks. - Untrack training-data/*.jsonl (~48MB, kept on disk) and gitignore *.jsonl. - Add .security-scan-allowlist for legit false positives: vendor name flexoptix, own homelab infra, sibling-project codenames in the sync journal, env-resolved DB URIs, example placeholders, ML tokenizer tokens. - Pre-push leak scanner goes from 397 to 0 findings, green without --no-verify. Follow-up (not in this commit): rotate the leaked values (llm_gateway first, tip fleet-wide coordinated); git history still holds the old passwords.
38 lines
1.2 KiB
Plaintext
38 lines
1.2 KiB
Plaintext
# transceiver-db pre-push scan allowlist. ERE, one pattern per line, matched against finding lines.
|
|
# This repo is Gitea-internal and is never published publicly; entries below are confirmed false positives.
|
|
# Risk note: a low-entropy secret sharing a line with an allowlisted token would be masked here.
|
|
# High-entropy secrets are still caught by the gitleaks pass, which ignores this allowlist.
|
|
# If this repo is ever made public, drop this file and run the internas sanitizer first.
|
|
# --- vendor name that is legitimate market-intelligence dataset subject matter ---
|
|
flexoptix
|
|
# --- owner homelab infra referenced in runbooks, docs and deploy scripts ---
|
|
82\.165\.222\.127
|
|
192\.168\.178\.
|
|
10\.10\.0\.
|
|
\berik\b
|
|
\bclaudi\b
|
|
renefichtmueller
|
|
fearghas
|
|
/opt/[a-z]
|
|
fichtmueller\.org
|
|
context-x\.org
|
|
# --- sibling project codenames referenced in the cross-project sync dev journal ---
|
|
\bmagatama
|
|
peercortex
|
|
switchblade
|
|
shieldx
|
|
papercortex
|
|
ctxevent
|
|
ctxmeet
|
|
nognet\.net
|
|
\bpulso\b
|
|
# --- env-resolved DB URIs and passwords, no literal secret present ---
|
|
postgres(ql)?://\$\{
|
|
\$\{DB_PASS\}
|
|
process\.env\.PGPASSWORD
|
|
# --- placeholder secret in example config ---
|
|
CHANGE_ME
|
|
# --- ML tokenizer special tokens, not credentials ---
|
|
special_tokens
|
|
pad_token
|