Stop shipping credentials as shell defaults - #36
Merged
Conversation
Four credentials were committed to this repository: a license key, and
admin, editor and viewer API keys. The repository is public, so all four
must be treated as compromised and rotated regardless of this change.
Every occurrence had the same shape - a real secret used as the fallback
in a ${VAR:-default} expansion, so the scripts kept working with no
environment set and nobody noticed the value was hardcoded.
Each is now a required variable using ${VAR:?message}, which fails
loudly instead of silently falling back to a shared credential, and
.env.example carries a placeholder rather than a working key.
This clears the working tree only. The values remain in history and are
removed separately.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was found
Four credentials are committed to this repository, which is public:
Every occurrence had the same shape — a real credential used as the fallback in a
${VAR:-default}expansion. The scripts therefore worked with no environment set, so nothing ever failed and the hardcoded value went unnoticed.What this changes
Six files, all at HEAD:
.env.exampleyour-license-key-herescripts/dev-up.sh${VECTORMBE_LICENSE_KEY:-<key>}${VECTORMBE_LICENSE_KEY:?…}deploy/recovery/health-check.sh${VECTORMBE_ADMIN_KEY:-<key>}${VECTORMBE_ADMIN_KEY:?…}deploy/recovery/simulate-failure.shdeploy/recovery/validate-deployment.shdeploy/recovery/watchdog.sh${VAR:?message}fails loudly with the message instead of silently falling back to a shared credential. That is the point of the change: a missing key should stop the script, not quietly authenticate as admin.Verified: no secret value remains anywhere at HEAD, and every modified script passes
bash -n.What this does not fix
Rotate all four keys. They have been readable in a public repository; this PR does not un-publish them. Rotation is the only step that restores control.
They remain in history — 21 commits across the four values. Removing them needs a
git filter-repopass and a force-push, which rewrites all 1661 commits and invalidates every existing clone. Held deliberately, pending rotation.Check what the frontend ships.
ui/dist-prod/env.jsassigns the admin key towindow.__VSS_ENV.VECTOROWL_API_KEY. That file is not at current HEAD, but it is in history, and any deployed build of that shape hands the admin key to every visitor — independent of GitHub, and unaffected by any history rewrite.🤖 Generated with Claude Code