# R-986 — first scan of today's main, every hit with a verdict (2026-10-19)

Tools: gitleaks 8.24.3 (default rules pinned, no repo ignore file), govulncheck v1.8.0 built with go1.27.2
(v1.1.4, the 2026-10-12 pin, panics on Go 1.27 source — `unexpected expr: *ast.KeyValueExpr` — so the
newest release older than two weeks was taken). Values were never printed: each line was read with every
value-like token replaced by its length and a hash prefix.

## govulncheck (called vulnerabilities only)

| module | called | imported/required only |
|---|---|---|
| felhom-controller `controller` | 0 | 1 |
| felhom.eu `hub` | 0 | 1 |
| felhom-agent `.` | 0 | 1 |
| app-catalog | no Go module | — |

## gitleaks — full history (`--all`)

| repo | commits | hits | 2026-10-12 review | new since |
|---|---|---|---|---|
| felhom-controller | 1370 | 12 | 12 | 0 |
| felhom.eu | 2102 | 50 | 43 | 7 (below) |
| felhom-agent | 539 | 15 | 15 | 0 |
| app-catalog-felhom.eu | 519 | 1 | 1 | 0 |

The 7 new history hits are files still in the tree (the usenet bench 5, the boot journal 1, r1140_accesslog_test.go 1) — their verdicts are in the tree table.

## gitleaks — today's tree (`git archive HEAD`)

Verdicts: **real** = a live secret (none); **accepted** = a value that opens nothing that matters now, listed in the repo's `.security-accepted`; **false** = not a secret.

| repo | n | rule | file | verdict | why |
|---|---|---|---|---|---|
| felhom-controller | 1 | generic-api-key | `controller/internal/backup/offbox_offer_shapec_r241_test.go` | false | a test constant or a decoy value, no live secret |
| felhom-controller | 1 | generic-api-key | `controller/internal/stacks/samba_test.go` | false | a test constant or a decoy value, no live secret |
| felhom-controller | 2 | generic-api-key | `controller/scripts/test_gate_decoys.py` | false | a test constant or a decoy value, no live secret |
| felhom.eu | 1 | generic-api-key | `documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt` | false | a tunnel ID (a UUID), not the tunnel token |
| felhom.eu | 1 | generic-api-key | `documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt` | false | a WireGuard PUBLIC key |
| felhom.eu | 1 | generic-api-key | `documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt` | false | a WireGuard PUBLIC key |
| felhom.eu | 1 | generic-api-key | `documentation/audits/family-gate-2026-10-02/tools/fg_items.py` | false | test strings in an audit tool (websocket probe labels) |
| felhom.eu | 1 | generic-api-key | `documentation/audits/new-apps-2026-10-01/tools/newapp_box.py` | accepted | a throwaway test user's password in an audit tool for a fresh-app walk on a Tier-0 box |
| felhom.eu | 1 | generic-api-key | `documentation/audits/night-2026-09-23/chaos/round-01-run.txt` | accepted | the same demo app session token as round-01.log |
| felhom.eu | 1 | generic-api-key | `documentation/audits/night-2026-09-23/chaos/round-01.log` | accepted | a demo app's session token, demo-hp 2026-09-23 (Tier 0); the 2026-10-12 review found no running demo app with it |
| felhom.eu | 1 | generic-api-key | `documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt` | accepted | a throwaway app's session cookie (wanderer probe, 2026-09-30, Tier 0) |
| felhom.eu | 3 | generic-api-key | `documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt` | false | an SSH key FINGERPRINT in a log line, not a key |
| felhom.eu | 1 | generic-api-key | `documentation/audits/permanent-gate-2026-10-01/tools/items12.py` | false | test strings in an audit tool (websocket probe labels) |
| felhom.eu | 1 | generic-api-key | `documentation/audits/power-cut-fixes-2026-10-14/E/demo-hp-journal-boot.txt` | false | the id of HP's public UEFI certificate in a boot journal |
| felhom.eu | 1 | generic-api-key | `documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py` | accepted | a throwaway wger walk's API token in an audit tool (Tier 0) |
| felhom.eu | 2 | generic-api-key | `documentation/audits/signup-lock-2026-09-29/B/wd.sh` | accepted | a stranger-probe test password in an audit script (signup lock, Tier 0) |
| felhom.eu | 1 | generic-api-key | `documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt` | accepted | a demo app's session token, demo-hp 2026-09-21 (Tier 0); no running demo app has it (2026-10-12 review) |
| felhom.eu | 1 | generic-api-key | `documentation/audits/update-night-2026-09-21/batchA.log` | accepted | the same demo app session token as actualbudget/log.txt |
| felhom.eu | 1 | generic-api-key | `documentation/audits/usenet-2026-10-12/nzbget-bench/03-process-and-entrypoint.txt` | accepted | a bench app's generated control password (LXC 9401, stopped; app removed from 9202 at teardown) |
| felhom.eu | 2 | generic-api-key | `documentation/audits/usenet-2026-10-12/sabnzbd-bench/02-telemetry-and-net.txt` | accepted | a bench app's generated API key (LXC 9401, stopped; app removed from 9202 at teardown) |
| felhom.eu | 2 | generic-api-key | `documentation/audits/usenet-2026-10-12/sabnzbd-bench/13-compose-resolved.txt` | accepted | a bench app's generated admin password and API key (LXC 9401, stopped; app removed from 9202) |
| felhom.eu | 2 | generic-api-key | `documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json` | accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
| felhom.eu | 3 | generic-api-key | `documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json` | accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
| felhom.eu | 1 | generic-api-key | `documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json` | accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
| felhom.eu | 7 | generic-api-key | `documentation/tests/campaign2-evidence-2026-07-07/state/runner.log` | accepted | the same dry-run deploy values in the campaign runner's log |
| felhom.eu | 2 | generic-api-key | `documentation/tests/walk5-r201-2026-08-07/journal.md` | false | sha256 digests compared in a walk journal, not secrets |
| felhom.eu | 1 | generic-api-key | `hub/internal/api/r1140_accesslog_test.go` | false | a test constant or a decoy value, no live secret |
| felhom.eu | 1 | generic-api-key | `hub/internal/store/r879_box_seal_test.go` | false | a test constant or a decoy value, no live secret |
| felhom.eu | 1 | generic-api-key | `hub/internal/web/bind_language_test.go` | false | a test constant or a decoy value, no live secret |
| felhom.eu | 1 | generic-api-key | `hub/internal/web/render_test.go` | false | a test constant or a decoy value, no live secret |
| felhom-agent | 1 | generic-api-key | `internal/escrow/identity_test.go` | false | a test constant or a decoy value, no live secret |
| felhom-agent | 11 | generic-api-key | `internal/escrow/recover_retained_test.go` | false | a test constant or a decoy value, no live secret |
| felhom-agent | 1 | generic-api-key | `internal/escrow/recover_test.go` | false | a test constant or a decoy value, no live secret |
| felhom-agent | 1 | generic-api-key | `internal/localapi/escrow_stage_test.go` | false | a test constant or a decoy value, no live secret |
| felhom-agent | 1 | generic-api-key | `internal/pbsdr/wrapper_read_test.go` | false | a test constant or a decoy value, no live secret |

**Real secrets: 0.** app-catalog-felhom.eu: 0 tree hits (its one history hit is a health-probe URL, the 2026-10-12 verdict).