Nothing checks commits or the built artifact for credentials. config.json is copied verbatim into dist/ and the Docker image; today gifApiKey is empty, but the moment it is filled in it is a public secret in a public repo and a public bundle (see #68 for the privacy side). The temporary Gitea token used for this audit is exactly the kind of thing that ends up in a scratch file and then a commit.
Suggested fix
Add gitleaks (or trufflehog) as a CI step on pull requests and as a lint-staged hook, with a baseline file for the known public homeserver URLs. Move any real third-party key out of config.json into a deploy-time substitution (the nginx image can template it) so the repo never carries it.
Filed from the September 2026 client audit (CI pipeline review, branch lotus @ 4bea4895).
**Location:** `.gitea/workflows/ci.yml`, `.husky/pre-commit` (lint-staged: eslint + prettier only), `vite.config.js` static-copy of `config.json`, `Dockerfile` (`COPY . /src/`)
### Problem
Nothing checks commits or the built artifact for credentials. `config.json` is copied verbatim into `dist/` and the Docker image; today `gifApiKey` is empty, but the moment it is filled in it is a public secret in a public repo and a public bundle (see #68 for the privacy side). The temporary Gitea token used for this audit is exactly the kind of thing that ends up in a scratch file and then a commit.
### Suggested fix
Add `gitleaks` (or `trufflehog`) as a CI step on pull requests and as a lint-staged hook, with a baseline file for the known public homeserver URLs. Move any real third-party key out of `config.json` into a deploy-time substitution (the nginx image can template it) so the repo never carries it.
---
_Filed from the September 2026 client audit (CI pipeline review, branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:57:44 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Location:
.gitea/workflows/ci.yml,.husky/pre-commit(lint-staged: eslint + prettier only),vite.config.jsstatic-copy ofconfig.json,Dockerfile(COPY . /src/)Problem
Nothing checks commits or the built artifact for credentials.
config.jsonis copied verbatim intodist/and the Docker image; todaygifApiKeyis empty, but the moment it is filled in it is a public secret in a public repo and a public bundle (see #68 for the privacy side). The temporary Gitea token used for this audit is exactly the kind of thing that ends up in a scratch file and then a commit.Suggested fix
Add
gitleaks(ortrufflehog) as a CI step on pull requests and as a lint-staged hook, with a baseline file for the known public homeserver URLs. Move any real third-party key out ofconfig.jsoninto a deploy-time substitution (the nginx image can template it) so the repo never carries it.Filed from the September 2026 client audit (CI pipeline review, branch
lotus@4bea4895).