security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

This commit is contained in:

windyboy

2026-09-26 12:26:57 +08:00

parent f77a4afd50

commit a3ee8c09cf

24 changed files with 77 additions and 75 deletions

03_Resources/Development/AI-ML/mcp-config.md

+1 -1

View File

@@ -5,6 +5,6 @@ created: 2026-01-05
 context7 mcp key:
 ```
 ctx7sk-92c2c98e-817e-41d4-bb85-94824444e2bf
 ctx7sk-{{SECRET_CONTEXT7_MCP}}（实际值见 Vaultwarden）
 ```