security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}} placeholders across 24 files (review-named 12 + noise-audit finds: WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key) - widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-, credential assignments & table cells, telegram bot tokens, conn strings - placeholder/default-value/config-name exemptions to kill doc FPs - skip .obsidian plugin code and frozen Inbox-Clippings from value scan - GIT_WORKFLOW: no git add ., verifier before commit, force-push exception - final regression: 0 flagged in tracked scope (was 43)
2026-09-26 12:26:57 +08:00
parent f77a4afd50
commit a3ee8c09cf
24 changed files with 77 additions and 75 deletions
@@ -298,7 +298,7 @@ docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endp


 ```
-docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
+docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="{{SECRET_WORK_ETCD_ROOT}}"
 ```