windyboy
a3ee8c09cf
security: scrub live credentials from tracked notes; point values at Vaultwarden
...
- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
placeholders across 24 files (review-named 12 + noise-audit finds:
WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)
2026-09-26 12:26:57 +08:00
windyboy
f77a4afd50
security: widen verifier (openssh/hyphenated-sk/ctx7sk/credential-assign/telegram/conn-string), fix GIT_WORKFLOW guidance
...
- BEGIN [A-Z0-9 ]*PRIVATE KEY now covers OPENSSH/RSA/EC variants
- sk- patterns tolerate hyphens and prefixed families (ctx7sk-)
- credential-assign catches PASSWORD=/token:/|API_KEY| tables (placeholder-aware)
- telegram bot tokens + connection strings with embedded passwords
- .obsidian/** third-party plugin code excluded from value scan (noise)
- regression: all 12 files named in REVIEW-FOLLOWUP now flagged
- GIT_WORKFLOW: drop git add . / Windows path, add verifier step,
note force-push exception for the one-time history rewrite
2026-09-26 12:09:11 +08:00
windyboy
aff829a1e2
refactor(vault): Phase 2 — root directory cleanup and clipper migration
...
- Remove dead services: .scripts/memory/, compose.yml, initdb/, specs/
- Remove root散件: package-lock.json, install.sh, LICENSE, FIRST_RUN,
.failed_images.txt, .upgrade-checklist.md, 未命名*.md, Untitled Kanban.md
- Move chinese-to-english-mapping.csv → .scripts/
- Migrate 00_Inbox/Clippings/ → 04_Archive/Inbox-Clippings/
- Fix self-nesting bug: 2024/11/2023/ → 2023/ (73 files relocated)
- Fix verifier false-positive on its own regex patterns
2026-09-26 11:34:50 +08:00
windyboy
652bdbc364
phase 1: stop the bleeding — untrack 91 files, add verifier, harden CI
...
- Remove 91 tracked-but-gitignored files from index (sessions, plugin
data/manifests, pycache, memory-changes, obsidian state, credential
notes). Disk files preserved via --cached.
- Add .gitignore rules: .qmd/, .memory-index.lock, *.sqlite-wal/shm,
13 credential note paths.
- Remove filename-blacklist ignore patterns (**/*password*.md etc.)
that caught nothing and misfired on normal notes.
- Add .scripts/verify-vault.mjs: scans git-tracked files for key
patterns (sk-*, AKIA*, gh[pousr]_*, glpat-*, xox*, BEGIN PRIVATE
KEY) and 64-char hex in plugin .json files.
- Add verifier step to CI lint workflow before dependency install.
2026-09-26 11:31:48 +08:00
windyboy