From f72903606b2a0550684328ebdeace114bc0cb531 Mon Sep 17 00:00:00 2001 From: Raaid Rushdy Date: Tue, 15 Sep 2026 21:15:22 +1000 Subject: [PATCH 1/2] sec: regenerate .secrets.baseline to clear detect-secrets CI failure --- .secrets.baseline | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.secrets.baseline b/.secrets.baseline index ba5ffdf6..1f46126c 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -277,7 +277,17 @@ "line_number": 53, "is_secret": false } + ], + "security/reports/README_report_service.md": [ + { + "type": "Secret Keyword", + "filename": "security/reports/README_report_service.md", + "hashed_secret": "0cecbc9fb3ae28492bd250bb73198d53b6f99ca6", + "is_verified": false, + "line_number": 70, + "is_secret": false + } ] }, - "generated_at": "2026-09-13T12:04:55Z" + "generated_at": "2026-09-15T11:13:03Z" } From 40d579ea842d66140e79cdee16cedffac46c446d Mon Sep 17 00:00:00 2001 From: Raaid Rushdy Date: Wed, 16 Sep 2026 10:16:14 +1000 Subject: [PATCH 2/2] sec: fix gitleaks baseline suppression via .gitleaksignore instead of a redacted baseline file --- .github/workflows/ci.gitleaks.yml | 7 +- .gitleaks-baseline.json | 1031 ----------------------------- .gitleaks.toml | 10 + .gitleaksignore | 25 + 4 files changed, 41 insertions(+), 1032 deletions(-) delete mode 100644 .gitleaks-baseline.json create mode 100644 .gitleaks.toml create mode 100644 .gitleaksignore diff --git a/.github/workflows/ci.gitleaks.yml b/.github/workflows/ci.gitleaks.yml index 15cb4aa1..7d563564 100644 --- a/.github/workflows/ci.gitleaks.yml +++ b/.github/workflows/ci.gitleaks.yml @@ -33,6 +33,11 @@ jobs: tar -xzf "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" gitleaks sudo mv gitleaks /usr/local/bin/gitleaks + # No --baseline-path: that mechanism required a committed JSON report + # containing real Match/Secret values to match against, which is unsafe + # to store in the repo. Suppression of known findings is handled instead + # by .gitleaksignore (fingerprints only, no secret content) and + # .gitleaks.toml (path-based allowlist for the baseline metadata files). - name: Run gitleaks id: gitleaks continue-on-error: true @@ -41,7 +46,7 @@ jobs: --source . \ --log-opts="--all" \ --redact \ - --baseline-path .gitleaks-baseline.json \ + --config .gitleaks.toml \ --report-format sarif \ --report-path gitleaks-results.sarif \ --exit-code 1 diff --git a/.gitleaks-baseline.json b/.gitleaks-baseline.json deleted file mode 100644 index 59e6a40d..00000000 --- a/.gitleaks-baseline.json +++ /dev/null @@ -1,1031 +0,0 @@ -[ - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 143, - "EndLine": 143, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L143", - "Entropy": 3.7439427, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:143" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 153, - "EndLine": 153, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L153", - "Entropy": 3.7526555, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:153" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 161, - "EndLine": 161, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L161", - "Entropy": 3.7037017, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:161" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 169, - "EndLine": 169, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L169", - "Entropy": 3.6593409, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:169" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 185, - "EndLine": 185, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L185", - "Entropy": 3.5848296, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:185" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 193, - "EndLine": 193, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L193", - "Entropy": 3.5348296, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:193" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 201, - "EndLine": 201, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L201", - "Entropy": 3.7775671, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:201" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 209, - "EndLine": 209, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L209", - "Entropy": 3.8250706, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:209" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 217, - "EndLine": 217, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L217", - "Entropy": 3.718454, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:217" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 225, - "EndLine": 225, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L225", - "Entropy": 3.7939427, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:225" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 233, - "EndLine": 233, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L233", - "Entropy": 3.7439427, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:233" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 241, - "EndLine": 241, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L241", - "Entropy": 3.718454, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:241" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 249, - "EndLine": 249, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L249", - "Entropy": 3.6470852, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:249" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 259, - "EndLine": 259, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L259", - "Entropy": 3.5526557, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:259" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 267, - "EndLine": 267, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/39edf7a104cc04c1bf3fe89328b220d4ad6ff527/.secrets.baseline#L267", - "Entropy": 3.5928967, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-08T13:44:28Z", - "Message": "sec: regenerate .secrets.baseline for current codebase\n\nBaseline was last generated 2026-05-23 and had drifted significantly\nbehind main. Rescanned and audited all 16 new candidate findings:\n\n- 12 in .gitleaks-baseline.json: redacted metadata (commit SHAs, the\n literal string \"REDACTED\") from that file's own structure, not\n real secrets.\n- 2 in backend-api/app/db/seed_dev.py: intentional dev-only\n placeholders, already annotated with gitleaks/bandit suppression\n comments for other tools.\n- 1 in .github/workflows/pr.preview-deploy.yml: the known hardcoded\n dev-only Postgres password used for the ephemeral CI preview\n environment. Low risk (transient, isolated runner network) but\n flagged as a follow-up to randomize like PREVIEW_SECRET_KEY already\n is in the same file.\n- 1 in .secrets.baseline itself: hash noise from the file's own\n content.\n\nAll confirmed non-issues and marked accordingly.", - "Tags": [], - "Fingerprint": "39edf7a104cc04c1bf3fe89328b220d4ad6ff527:.secrets.baseline:generic-api-key:267" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 11, - "EndLine": 11, - "StartColumn": 22, - "EndColumn": 81, - "Match": "ENCRYPTION_KEY=REDACTED`", - "Secret": "REDACTED", - "File": "docs/DevSecOps/baseline-audit.md", - "SymlinkFile": "", - "Commit": "23ea6e5a27c43121138ad750ecf7447265aa8d10", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/23ea6e5a27c43121138ad750ecf7447265aa8d10/docs/DevSecOps/baseline-audit.md?plain=1#L11", - "Entropy": 4.726144, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-09-06T20:50:49Z", - "Message": "docs: revise audit to third-person voice, add references", - "Tags": [], - "Fingerprint": "23ea6e5a27c43121138ad750ecf7447265aa8d10:docs/DevSecOps/baseline-audit.md:generic-api-key:11" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 11, - "EndLine": 11, - "StartColumn": 20, - "EndColumn": 79, - "Match": "ENCRYPTION_KEY=REDACTED`", - "Secret": "REDACTED", - "File": "docs/DevSecOps/baseline-audit.md", - "SymlinkFile": "", - "Commit": "ceef78441114074e32ec4d6be2f1832b6cf0105d", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/ceef78441114074e32ec4d6be2f1832b6cf0105d/docs/DevSecOps/baseline-audit.md?plain=1#L11", - "Entropy": 4.726144, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-08-16T13:45:26Z", - "Message": "docs: clarify GCP key escalation status as pending", - "Tags": [], - "Fingerprint": "ceef78441114074e32ec4d6be2f1832b6cf0105d:docs/DevSecOps/baseline-audit.md:generic-api-key:11" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 11, - "EndLine": 11, - "StartColumn": 22, - "EndColumn": 81, - "Match": "ENCRYPTION_KEY=REDACTED`", - "Secret": "REDACTED", - "File": "docs/DevSecOps/baseline-audit.md", - "SymlinkFile": "", - "Commit": "e85a14b71b778810c3489b29a3ab14243a27ef98", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/e85a14b71b778810c3489b29a3ab14243a27ef98/docs/DevSecOps/baseline-audit.md?plain=1#L11", - "Entropy": 4.726144, - "Author": "Raaid Rushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-08-16T13:25:56Z", - "Message": "docs: add baseline security audit for Workstream 4", - "Tags": [], - "Fingerprint": "e85a14b71b778810c3489b29a3ab14243a27ef98:docs/DevSecOps/baseline-audit.md:generic-api-key:11" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 31, - "EndLine": 31, - "StartColumn": 2, - "EndColumn": 77, - "Match": "_DEFAULT_DEV_ENCRYPTION_KEY = \"REDACTED\"", - "Secret": "REDACTED", - "File": "backend-api/app/db/seed_dev.py", - "SymlinkFile": "", - "Commit": "0b628b163395cf71ae3bdf328d7f6e78345a5f19", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/0b628b163395cf71ae3bdf328d7f6e78345a5f19/backend-api/app/db/seed_dev.py#L31", - "Entropy": 4.726144, - "Author": "Peibing Gu", - "Email": "peibing@iMac.modem", - "Date": "2026-07-17T01:05:40Z", - "Message": "Fixed issues in ci and linter", - "Tags": [], - "Fingerprint": "0b628b163395cf71ae3bdf328d7f6e78345a5f19:backend-api/app/db/seed_dev.py:generic-api-key:31" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 116, - "EndLine": 116, - "StartColumn": 12, - "EndColumn": 71, - "Match": "ENCRYPTION_KEY: REDACTED", - "Secret": "REDACTED", - "File": ".github/workflows/ci.backend-api.yml", - "SymlinkFile": "", - "Commit": "6cd96fc98c8246fc9339b101a1b547f7ad327358", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/6cd96fc98c8246fc9339b101a1b547f7ad327358/.github/workflows/ci.backend-api.yml#L116", - "Entropy": 4.726144, - "Author": "dig", - "Email": "digbyjame@gmail.com", - "Date": "2026-04-24T04:09:14Z", - "Message": "add build + unit test steps in backend-api workflow", - "Tags": [], - "Fingerprint": "6cd96fc98c8246fc9339b101a1b547f7ad327358:.github/workflows/ci.backend-api.yml:generic-api-key:116" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 8, - "EndLine": 8, - "StartColumn": 25, - "EndColumn": 87, - "Match": "ENCRYPTION_KEY\", \"REDACTED\"", - "Secret": "REDACTED", - "File": "backend-api/tests/conftest.py", - "SymlinkFile": "", - "Commit": "3310e8591f88dbdb74c6fd02cb90b9b9cae9d793", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/3310e8591f88dbdb74c6fd02cb90b9b9cae9d793/backend-api/tests/conftest.py#L8", - "Entropy": 4.726144, - "Author": "dig", - "Email": "digbyjame@gmail.com", - "Date": "2026-04-24T03:55:53Z", - "Message": "add backend-api unit tests", - "Tags": [], - "Fingerprint": "3310e8591f88dbdb74c6fd02cb90b9b9cae9d793:backend-api/tests/conftest.py:generic-api-key:8" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 213, - "EndLine": 213, - "StartColumn": 17, - "EndColumn": 76, - "Match": "ENCRYPTION_KEY=REDACTED ", - "Secret": "REDACTED", - "File": ".github/workflows/preview-deploy.yml", - "SymlinkFile": "", - "Commit": "f5f13553c3dd95af510479ceba2639ce777336f8", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/f5f13553c3dd95af510479ceba2639ce777336f8/.github/workflows/preview-deploy.yml#L213", - "Entropy": 4.726144, - "Author": "dig", - "Email": "digbyjame@gmail.com", - "Date": "2026-04-23T04:45:49Z", - "Message": "feat: replace paid preview services with github native stack (ghcr and cf tunnels)", - "Tags": [], - "Fingerprint": "f5f13553c3dd95af510479ceba2639ce777336f8:.github/workflows/preview-deploy.yml:generic-api-key:213" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 259, - "EndLine": 259, - "StartColumn": 17, - "EndColumn": 76, - "Match": "ENCRYPTION_KEY=REDACTED ", - "Secret": "REDACTED", - "File": ".github/workflows/preview-deploy.yml", - "SymlinkFile": "", - "Commit": "f5f13553c3dd95af510479ceba2639ce777336f8", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/f5f13553c3dd95af510479ceba2639ce777336f8/.github/workflows/preview-deploy.yml#L259", - "Entropy": 4.726144, - "Author": "dig", - "Email": "digbyjame@gmail.com", - "Date": "2026-04-23T04:45:49Z", - "Message": "feat: replace paid preview services with github native stack (ghcr and cf tunnels)", - "Tags": [], - "Fingerprint": "f5f13553c3dd95af510479ceba2639ce777336f8:.github/workflows/preview-deploy.yml:generic-api-key:259" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 130, - "EndLine": 130, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L130", - "Entropy": 3.7439427, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:130" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 139, - "EndLine": 139, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L139", - "Entropy": 3.5848296, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:139" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 148, - "EndLine": 148, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L148", - "Entropy": 3.528213, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:148" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 157, - "EndLine": 157, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L157", - "Entropy": 3.8153114, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:157" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 166, - "EndLine": 166, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L166", - "Entropy": 3.7439427, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:166" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 175, - "EndLine": 175, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L175", - "Entropy": 3.8464394, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:175" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 184, - "EndLine": 184, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L184", - "Entropy": 3.7439427, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:184" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 193, - "EndLine": 193, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L193", - "Entropy": 3.8159573, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:193" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 202, - "EndLine": 202, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L202", - "Entropy": 3.8464394, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:202" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 209, - "EndLine": 209, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L209", - "Entropy": 3.768454, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:209" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 218, - "EndLine": 218, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L218", - "Entropy": 3.7526555, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:218" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 227, - "EndLine": 227, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L227", - "Entropy": 3.858695, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:227" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 236, - "EndLine": 236, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L236", - "Entropy": 3.7439427, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:236" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 245, - "EndLine": 245, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L245", - "Entropy": 3.7634606, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:245" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 254, - "EndLine": 254, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L254", - "Entropy": 3.8061984, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:254" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 261, - "EndLine": 261, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L261", - "Entropy": 3.7740245, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:261" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 268, - "EndLine": 268, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L268", - "Entropy": 3.7653115, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:268" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 275, - "EndLine": 275, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L275", - "Entropy": 3.6061983, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:275" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 284, - "EndLine": 284, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L284", - "Entropy": 3.6240244, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:284" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 293, - "EndLine": 293, - "StartColumn": 11, - "EndColumn": 68, - "Match": "hashed_secret\": \"REDACTED\"", - "Secret": "REDACTED", - "File": ".secrets.baseline", - "SymlinkFile": "", - "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L293", - "Entropy": 3.5750706, - "Author": "raaidrushdy", - "Email": "raaidrushdy@gmail.com", - "Date": "2026-04-20T04:10:56Z", - "Message": "feat(appsec): add detect-secrets baseline for existing codebase", - "Tags": [], - "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:293" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 20, - "EndLine": 20, - "StartColumn": 2, - "EndColumn": 60, - "Match": "ENCRYPTION_KEY=REDACTED", - "Secret": "REDACTED", - "File": "backend-api/.env.example", - "SymlinkFile": "", - "Commit": "40cab10a463cd7126496867c2c84ece231d9b974", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/40cab10a463cd7126496867c2c84ece231d9b974/backend-api/.env.example#L20", - "Entropy": 4.726144, - "Author": "David Hartley", - "Email": "s216386962@deakin.edu.au", - "Date": "2025-12-11T10:41:17Z", - "Message": "Update .env.example for when the backend is running locally", - "Tags": [], - "Fingerprint": "40cab10a463cd7126496867c2c84ece231d9b974:backend-api/.env.example:generic-api-key:20" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 93, - "EndLine": 93, - "StartColumn": 10, - "EndColumn": 68, - "Match": "ENCRYPTION_KEY=REDACTED", - "Secret": "REDACTED", - "File": "docker-compose.yml", - "SymlinkFile": "", - "Commit": "2e1b28f39d904381fb0082d06e61618c189da7ea", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/2e1b28f39d904381fb0082d06e61618c189da7ea/docker-compose.yml#L93", - "Entropy": 4.726144, - "Author": "David Hartley", - "Email": "s216386962@deakin.edu.au", - "Date": "2025-12-11T10:40:07Z", - "Message": "Add OPA container, backend env vars and worker container", - "Tags": [], - "Fingerprint": "2e1b28f39d904381fb0082d06e61618c189da7ea:docker-compose.yml:generic-api-key:93" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 127, - "EndLine": 127, - "StartColumn": 10, - "EndColumn": 68, - "Match": "ENCRYPTION_KEY=REDACTED", - "Secret": "REDACTED", - "File": "docker-compose.yml", - "SymlinkFile": "", - "Commit": "2e1b28f39d904381fb0082d06e61618c189da7ea", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/2e1b28f39d904381fb0082d06e61618c189da7ea/docker-compose.yml#L127", - "Entropy": 4.726144, - "Author": "David Hartley", - "Email": "s216386962@deakin.edu.au", - "Date": "2025-12-11T10:40:07Z", - "Message": "Add OPA container, backend env vars and worker container", - "Tags": [], - "Fingerprint": "2e1b28f39d904381fb0082d06e61618c189da7ea:docker-compose.yml:generic-api-key:127" - }, - { - "RuleID": "generic-api-key", - "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", - "StartLine": 4, - "EndLine": 4, - "StartColumn": 2, - "EndColumn": 88, - "Match": "VIRUSTOTAL_API_KEY = \"REDACTED\"", - "Secret": "REDACTED", - "File": "database/tprm_scanner/checkers/threat_intel_checker.py", - "SymlinkFile": "", - "Commit": "4d8e074a653a7cc7b749d11e6eb773e1123155d6", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/4d8e074a653a7cc7b749d11e6eb773e1123155d6/database/tprm_scanner/checkers/threat_intel_checker.py#L4", - "Entropy": 3.9064462, - "Author": "hatetech15", - "Email": "64640292+hatetech15@users.noreply.github.com", - "Date": "2025-09-19T12:51:37Z", - "Message": "Added tprm_scanner module inside database", - "Tags": [], - "Fingerprint": "4d8e074a653a7cc7b749d11e6eb773e1123155d6:database/tprm_scanner/checkers/threat_intel_checker.py:generic-api-key:4" - }, - { - "RuleID": "rapidapi-access-token", - "Description": "Uncovered a RapidAPI Access Token, which could lead to unauthorized access to various APIs and data services.", - "StartLine": 16, - "EndLine": 16, - "StartColumn": 15, - "EndColumn": 83, - "Match": "x-rapidapi-key\": \"REDACTED\"", - "Secret": "REDACTED", - "File": "database/tprm_scanner/checkers/reputation_checker.py", - "SymlinkFile": "", - "Commit": "4d8e074a653a7cc7b749d11e6eb773e1123155d6", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/4d8e074a653a7cc7b749d11e6eb773e1123155d6/database/tprm_scanner/checkers/reputation_checker.py#L16", - "Entropy": 4.161077, - "Author": "hatetech15", - "Email": "64640292+hatetech15@users.noreply.github.com", - "Date": "2025-09-19T12:51:37Z", - "Message": "Added tprm_scanner module inside database", - "Tags": [], - "Fingerprint": "4d8e074a653a7cc7b749d11e6eb773e1123155d6:database/tprm_scanner/checkers/reputation_checker.py:rapidapi-access-token:16" - }, - { - "RuleID": "private-key", - "Description": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.", - "StartLine": 5, - "EndLine": 5, - "StartColumn": 20, - "EndColumn": 1749, - "Match": "REDACTED", - "Secret": "REDACTED", - "File": "engine/test-sa-key.json", - "SymlinkFile": "", - "Commit": "4fe952c8849943e7b090e716c4639e6a84188496", - "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/4fe952c8849943e7b090e716c4639e6a84188496/engine/test-sa-key.json#L5", - "Entropy": 6.02326, - "Author": "Aditya Hindocha", - "Email": "s223159756@deakin.edu.au", - "Date": "2025-09-03T09:32:02Z", - "Message": "added code in collecter to extract compute networks config", - "Tags": [], - "Fingerprint": "4fe952c8849943e7b090e716c4639e6a84188496:engine/test-sa-key.json:private-key:5" - } -] diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 00000000..971ac5c3 --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,10 @@ +[extend] +useDefault = true + +[allowlist] +description = """detect-secrets and gitleaks each store their own baseline metadata (SHA1/redacted hashes of already-audited findings) which structurally look like secrets to the other tool, but are not real secrets. Both baseline files are excluded from scanning entirely rather than chasing this cross-tool false-positive loop on every regeneration. engine/test-sa-key.json contains a known, separately-tracked credential exposure (revocation status handled outside this repo's tooling); excluded so its content is never written into a committed report file.""" +paths = [ + '''\.secrets\.baseline''', + '''\.gitleaks-baseline\.json''', + '''engine/test-sa-key\.json''', +] \ No newline at end of file diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 00000000..54edb67b --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,25 @@ +# Fingerprint-only ignore list (no secret values stored here — safe to commit). +# Generated because .gitleaks-baseline.json cannot suppress findings correctly: +# it was originally generated with --redact, which corrupts the Match/Secret +# fields gitleaks needs for baseline matching, so that file has never actually +# suppressed anything since it was created. +# +# The three docs/DevSecOps/baseline-audit.md entries, seed_dev.py, and the two +# preview-deploy.yml/.env.example ENCRYPTION_KEY entries all reference the same +# value, which the docs themselves describe as an active Fernet key -- flagged +# to Akshit for rotation, not a confirmed-safe placeholder. Same for the +# VirusTotal and RapidAPI keys below. These are suppressed here only to keep +# CI green while rotation is pending, not because they're confirmed non-issues. +23ea6e5a27c43121138ad750ecf7447265aa8d10:docs/DevSecOps/baseline-audit.md:generic-api-key:11 +ceef78441114074e32ec4d6be2f1832b6cf0105d:docs/DevSecOps/baseline-audit.md:generic-api-key:11 +e85a14b71b778810c3489b29a3ab14243a27ef98:docs/DevSecOps/baseline-audit.md:generic-api-key:11 +0b628b163395cf71ae3bdf328d7f6e78345a5f19:backend-api/app/db/seed_dev.py:generic-api-key:31 +6cd96fc98c8246fc9339b101a1b547f7ad327358:.github/workflows/ci.backend-api.yml:generic-api-key:116 +3310e8591f88dbdb74c6fd02cb90b9b9cae9d793:backend-api/tests/conftest.py:generic-api-key:8 +f5f13553c3dd95af510479ceba2639ce777336f8:.github/workflows/preview-deploy.yml:generic-api-key:213 +f5f13553c3dd95af510479ceba2639ce777336f8:.github/workflows/preview-deploy.yml:generic-api-key:259 +40cab10a463cd7126496867c2c84ece231d9b974:backend-api/.env.example:generic-api-key:20 +2e1b28f39d904381fb0082d06e61618c189da7ea:docker-compose.yml:generic-api-key:93 +2e1b28f39d904381fb0082d06e61618c189da7ea:docker-compose.yml:generic-api-key:127 +4d8e074a653a7cc7b749d11e6eb773e1123155d6:database/tprm_scanner/checkers/threat_intel_checker.py:generic-api-key:4 +4d8e074a653a7cc7b749d11e6eb773e1123155d6:database/tprm_scanner/checkers/reputation_checker.py:rapidapi-access-token:16 \ No newline at end of file