fix(security): env secret-leak hardening — bracket→dot + release scan guard#73
Open
selimmujdeci wants to merge 2 commits into
Open
fix(security): env secret-leak hardening — bracket→dot + release scan guard#73selimmujdeci wants to merge 2 commits into
selimmujdeci wants to merge 2 commits into
Conversation
…lease scan guard
Gizli AI anahtarlari (Gemini/Claude/Groq) gecmiste bracket (dinamik)
import.meta.env[...] erisimi yuzunden TUM env objesiyle derlenmis bundle'a
serialize oluyordu. Guncel .env temiz olsa da yapisal sizinti vektoru duruyordu:
biri .env'e tekrar anahtar koyunca sessizce APK'ya gomulurdu.
- aiVoiceService: getEnv{Gemini,Haiku,Groq}Key -> statik NOKTA erisimi
- mediaCredentials: dinamik env[name] -> acik per-provider nokta erisimi
- scripts/scan-secrets.mjs: release bundle gercek-anahtar-sekilli literal tarayici
(regex-kaynagi/placeholder/Firebase-public/test-fixture yanlis-pozitiflerini eler)
- CI (main.yml) build job + apk:safe pipeline'a scan:secrets kapisi
- 8 unit test: yakalama + yanlis-pozitif elemesi + REDACTED gizleme kilidi
Dogrulama: taze dist'te VITE_*_API_KEY isimleri artik HIC yok (once useStore
bundle'inda env-obje olarak vardi); scan temiz (249 varlik); 3579 test yesil; tsc
temiz; lint 0 error. BYOK ve native secure storage davranisi degismedi.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141GKY1eQru4Ap1PWN4VVst
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
… cihaz bekliyor Bracket->dot + release scan guard host-dogrulandi (CI yesil); taze APK'da eski anahtar yoklugu + BYOK akisi cihazda dogrulanmali. Provider rotate manuel adim. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0141GKY1eQru4Ap1PWN4VVst
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Amaç
Gizli AI anahtarlarinin (Gemini/Claude/Groq/xAI) derlenmis release bundle'a
sizmasini yapisal olarak engelle. Guncel
.envzaten temiz; bu PR sizintivektorunu kapatir ve son savunma olarak release-bundle secret taramasi ekler.
Kok neden
import.meta.env['VITE_...']bracket (dinamik) erisimi Vite'in per-key statikdegistirmesini kirip tum env objesini bundle'a serialize ediyordu. Sonuc:
.env'ekonan her gizli anahtar dagitilan APK'ya literal gomulurdu (decompile ile 30sn'de cikar).
Degisiklikler
src/platform/aiVoiceService.tsgetEnv{Gemini,Haiku,Groq}Key-> statik NOKTA erisimisrc/platform/media/mediaCredentials.tsenv[name]-> acik per-provider nokta erisimiscripts/scan-secrets.mjs.github/workflows/main.ymlscan:secretskapisipackage.jsonscan:secretsscript +apk:safepipeline'a eklendisrc/__tests__/scan-secrets.test.tsTarayici tasarimi (yanlis-pozitif guvenligi)
Bundle mesru olarak BYOK dogrulama regex kaynaklari (
sk-ant-[A-Za-z0-9_-]{20,}),sk-ant-...placeholder metni ve Firebase public anahtari icerir. Desenlergercek anahtar onekleri + uzun bitisik alnum ile daraltildi; Firebase + test-fixture
allowlist'te. Gercek gizli deger ASLA loglanmaz — yalniz
REDACTEDonek.Dogrulama
VITE_*_API_KEYisimleri artik HIC yok (once useStore bundle'indaenv-obje property olarak vardi) -> serializasyon vektoru olctu ile kalkti
npm run scan:secretstaze dist'te temiz (249 varlik)tsc -btemiz · lint 0 errorOnemli baglam
Uygulama henuz dagitimda degil (yapim asamasi) -> bu acil blocker degil, yapisal
hijyen + regresyon kilidi. Ilgili eski (fix-oncesi) APK'larda gercek anahtar literal'i
bulundu; provider tarafinda rotate kullanicinin manuel adimi olarak onerilir.
🤖 Generated with Claude Code