coulomb/prj-forgejo-org-refactor
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ORGREF-WP-0002-T03 done: exposed-history review

Browse source 
One real exposure (Nextcloud backup token in railiance-backup, two repos),
routed to owners for rotation; no values recorded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
This commit is contained in:
tegwick 2026-10-08 19:37:25 +02:00
parent 51299344c5
commit 935b199316
2 changed files with 61 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md
View file

@ -180,7 +180,7 @@ confirmation moves to the owners under T06.
```task
id: ORGREF-WP-0002-T03
status: todo
status: done
priority: high
state_hub_task_id: "9c2ca7be-23f8-58c5-9bfd-e44a26ce4584"
```
@ -194,6 +194,15 @@ rotation through `warden route`. Closing a repository does not un-publish
history, so a leaked credential needs rotating either way. Record the scan scope
and results without reproducing any value.
2026-10-08: done. gitleaks (redacted) over all local refs of 160 forge
repositories: 283 findings in 25 repositories. One real exposure: a Nextcloud
backup token (`NC_TOKEN`) hardcoded in `tools/cmd/railiance-backup` in
railiance-bootstrap and railiance-cluster, public since 2026-02-25 and still in
HEAD. Routed to both owners for revocation, OpenBao custody and removal. The
rest is benign (identifiers, digests, test fixtures, placeholders). Record and
limits: `inventory/history-exposure-2026-10-08.md`. The rotation is tracked with
the owners.
```task
id: ORGREF-WP-0002-T04
status: wait