7.5 KiB
7.5 KiB
R-986 — first scan of today's main, every hit with a verdict (2026-10-19)
Tools: gitleaks 8.24.3 (default rules pinned, no repo ignore file), govulncheck v1.8.0 built with go1.27.2
(v1.1.4, the 2026-10-12 pin, panics on Go 1.27 source — unexpected expr: *ast.KeyValueExpr — so the
newest release older than two weeks was taken). Values were never printed: each line was read with every
value-like token replaced by its length and a hash prefix.
govulncheck (called vulnerabilities only)
| module | called | imported/required only |
|---|---|---|
felhom-controller controller |
0 | 1 |
felhom.eu hub |
0 | 1 |
felhom-agent . |
0 | 1 |
| app-catalog | no Go module | — |
gitleaks — full history (--all)
| repo | commits | hits | 2026-10-12 review | new since |
|---|---|---|---|---|
| felhom-controller | 1370 | 12 | 12 | 0 |
| felhom.eu | 2102 | 50 | 43 | 7 (below) |
| felhom-agent | 539 | 15 | 15 | 0 |
| app-catalog-felhom.eu | 519 | 1 | 1 | 0 |
The 7 new history hits are files still in the tree (the usenet bench 5, the boot journal 1, r1140_accesslog_test.go 1) — their verdicts are in the tree table.
gitleaks — today's tree (git archive HEAD)
Verdicts: real = a live secret (none); accepted = a value that opens nothing that matters now, listed in the repo's .security-accepted; false = not a secret.
| repo | n | rule | file | verdict | why |
|---|---|---|---|---|---|
| felhom-controller | 1 | generic-api-key | controller/internal/backup/offbox_offer_shapec_r241_test.go |
false | a test constant or a decoy value, no live secret |
| felhom-controller | 1 | generic-api-key | controller/internal/stacks/samba_test.go |
false | a test constant or a decoy value, no live secret |
| felhom-controller | 2 | generic-api-key | controller/scripts/test_gate_decoys.py |
false | a test constant or a decoy value, no live secret |
| felhom.eu | 1 | generic-api-key | documentation/audits/evidence-fixes-first-tester-2026-09-30/part0/cloudflare-dns.txt |
false | a tunnel ID (a UUID), not the tunnel token |
| felhom.eu | 1 | generic-api-key | documentation/audits/evidence-rehearsal-2026-08-09/GATE0-demo-hp-before.txt |
false | a WireGuard PUBLIC key |
| felhom.eu | 1 | generic-api-key | documentation/audits/evidence-rehearsal-2026-08-09/P1-demo-hp-after.txt |
false | a WireGuard PUBLIC key |
| felhom.eu | 1 | generic-api-key | documentation/audits/family-gate-2026-10-02/tools/fg_items.py |
false | test strings in an audit tool (websocket probe labels) |
| felhom.eu | 1 | generic-api-key | documentation/audits/new-apps-2026-10-01/tools/newapp_box.py |
accepted | a throwaway test user's password in an audit tool for a fresh-app walk on a Tier-0 box |
| felhom.eu | 1 | generic-api-key | documentation/audits/night-2026-09-23/chaos/round-01-run.txt |
accepted | the same demo app session token as round-01.log |
| felhom.eu | 1 | generic-api-key | documentation/audits/night-2026-09-23/chaos/round-01.log |
accepted | a demo app's session token, demo-hp 2026-09-23 (Tier 0); the 2026-10-12 review found no running demo app with it |
| felhom.eu | 1 | generic-api-key | documentation/audits/night-rulings-2026-09-30/D/D3-wanderer-routes-probe.txt |
accepted | a throwaway app's session cookie (wanderer probe, 2026-09-30, Tier 0) |
| felhom.eu | 3 | generic-api-key | documentation/audits/offsite-lock-build-2026-10-03/partD/demo-hp-migration.txt |
false | an SSH key FINGERPRINT in a log line, not a key |
| felhom.eu | 1 | generic-api-key | documentation/audits/permanent-gate-2026-10-01/tools/items12.py |
false | test strings in an audit tool (websocket probe labels) |
| felhom.eu | 1 | generic-api-key | documentation/audits/power-cut-fixes-2026-10-14/E/demo-hp-journal-boot.txt |
false | the id of HP's public UEFI certificate in a boot journal |
| felhom.eu | 1 | generic-api-key | documentation/audits/r890-instructions-2026-10-06/tools/wgerwalk.py |
accepted | a throwaway wger walk's API token in an audit tool (Tier 0) |
| felhom.eu | 2 | generic-api-key | documentation/audits/signup-lock-2026-09-29/B/wd.sh |
accepted | a stranger-probe test password in an audit script (signup lock, Tier 0) |
| felhom.eu | 1 | generic-api-key | documentation/audits/update-night-2026-09-21/apps/actualbudget/log.txt |
accepted | a demo app's session token, demo-hp 2026-09-21 (Tier 0); no running demo app has it (2026-10-12 review) |
| felhom.eu | 1 | generic-api-key | documentation/audits/update-night-2026-09-21/batchA.log |
accepted | the same demo app session token as actualbudget/log.txt |
| felhom.eu | 1 | generic-api-key | documentation/audits/usenet-2026-10-12/nzbget-bench/03-process-and-entrypoint.txt |
accepted | a bench app's generated control password (LXC 9401, stopped; app removed from 9202 at teardown) |
| felhom.eu | 2 | generic-api-key | documentation/audits/usenet-2026-10-12/sabnzbd-bench/02-telemetry-and-net.txt |
accepted | a bench app's generated API key (LXC 9401, stopped; app removed from 9202 at teardown) |
| felhom.eu | 2 | generic-api-key | documentation/audits/usenet-2026-10-12/sabnzbd-bench/13-compose-resolved.txt |
accepted | a bench app's generated admin password and API key (LXC 9401, stopped; app removed from 9202) |
| felhom.eu | 2 | generic-api-key | documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_bookstack.json |
accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
| felhom.eu | 3 | generic-api-key | documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_paperless-ngx.json |
accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
| felhom.eu | 1 | generic-api-key | documentation/tests/campaign2-evidence-2026-07-07/evidence/T-DEPLOY-SET/values_vaultwarden.json |
accepted | dry-run deploy values of a 2026-07-07 campaign (generated, demo boxes since rebuilt) |
| felhom.eu | 7 | generic-api-key | documentation/tests/campaign2-evidence-2026-07-07/state/runner.log |
accepted | the same dry-run deploy values in the campaign runner's log |
| felhom.eu | 2 | generic-api-key | documentation/tests/walk5-r201-2026-08-07/journal.md |
false | sha256 digests compared in a walk journal, not secrets |
| felhom.eu | 1 | generic-api-key | hub/internal/api/r1140_accesslog_test.go |
false | a test constant or a decoy value, no live secret |
| felhom.eu | 1 | generic-api-key | hub/internal/store/r879_box_seal_test.go |
false | a test constant or a decoy value, no live secret |
| felhom.eu | 1 | generic-api-key | hub/internal/web/bind_language_test.go |
false | a test constant or a decoy value, no live secret |
| felhom.eu | 1 | generic-api-key | hub/internal/web/render_test.go |
false | a test constant or a decoy value, no live secret |
| felhom-agent | 1 | generic-api-key | internal/escrow/identity_test.go |
false | a test constant or a decoy value, no live secret |
| felhom-agent | 11 | generic-api-key | internal/escrow/recover_retained_test.go |
false | a test constant or a decoy value, no live secret |
| felhom-agent | 1 | generic-api-key | internal/escrow/recover_test.go |
false | a test constant or a decoy value, no live secret |
| felhom-agent | 1 | generic-api-key | internal/localapi/escrow_stage_test.go |
false | a test constant or a decoy value, no live secret |
| felhom-agent | 1 | generic-api-key | internal/pbsdr/wrapper_read_test.go |
false | a test constant or a decoy value, no live secret |
Real secrets: 0. app-catalog-felhom.eu: 0 tree hits (its one history hit is a health-probe URL, the 2026-10-12 verdict).