86d1531d52
- Replace plaintext tip (transceiver_db) and llm_gateway DB passwords with env-var references guarded by fail-fast checks, across 15 scripts + sql runbook. Covers quoted exports, unquoted psql calls, python env dicts and env-or-hardcoded-default fallbacks. - Untrack training-data/*.jsonl (~48MB, kept on disk) and gitignore *.jsonl. - Add .security-scan-allowlist for legit false positives: vendor name flexoptix, own homelab infra, sibling-project codenames in the sync journal, env-resolved DB URIs, example placeholders, ML tokenizer tokens. - Pre-push leak scanner goes from 397 to 0 findings, green without --no-verify. Follow-up (not in this commit): rotate the leaked values (llm_gateway first, tip fleet-wide coordinated); git history still holds the old passwords.
29 lines
527 B
Plaintext
29 lines
527 B
Plaintext
node_modules/
|
|
dist/
|
|
*.tsbuildinfo
|
|
.DS_Store
|
|
.env*
|
|
.dev.vars
|
|
*.local
|
|
wrangler.toml
|
|
ecosystem.config.js
|
|
|
|
# Downloaded product assets (images, PDFs)
|
|
assets/images/
|
|
assets/datasheets/
|
|
assets/manuals/
|
|
|
|
# Crawlee runtime artifacts (all scraper-specific storage dirs)
|
|
storage/
|
|
storage-*/
|
|
.crawlee/
|
|
|
|
# Local credentials (never commit)
|
|
.tip/.env
|
|
run-fs-scraper-mac.sh.local
|
|
|
|
# Training / SFT datasets — bulk data + potential internal pricing/market intel, keep out of git
|
|
*.jsonl
|
|
training-data/runpod/**/*.jsonl
|
|
training-data/*.jsonl
|