R: close exposed-credential remediation (operator machine) #119
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Status 2026-10-13: no row closed yet; all remaining items need the operator machine. New today: the Vaultwarden/Authelia rotation (PR #125) means any copy of the old values in shell history or transcripts is now stale once deployed, but the exposed-credential rows below still apply.
Track R is separate from the migration; open rows are in
docs/secrets-remediation.md..env/.env.bakcopies sit there). Treat any credential never rotated since the cutover as exposed to that disk.~/.zsh_historyand Claude Code session transcripts for token prefixes; rotate any hit. Key names only in output; never cat/grep values into the terminal.secrets/backup/(pre-cutover Ansible Vault ciphertext) at Ansible Vault retirement; deleting the vault password first makes those files unreadable, so decide before retiring.coaching_site_git_deploy_keyininventory/host_vars/staging-web.yml(committed at42033c6): confirm you do not remember it as a real deploy key (it failsssh-keygen); keep the gitleaks baseline entry..env.examplefinding at131451e: confirmed false positive; keep the baseline entry.OBJECT_STORAGE_*again: Terraform state and restic still share one key (the CI replica is separate).R update 2026-10-14: unchanged: no row closed. The shell-history/transcript search was not run (auto mode refused decrypting the vault to compare current values against
~/.zsh_historyand the Claude Code transcripts, even with a names-and-counts-only script); it needs you to run it or to allow a script that does it. Still open: empty the macOS Trash, decide onsecrets/backup/(delete the password first makes the files unreadable),coaching_site_git_deploy_keyconfirmation, whether to rotateOBJECT_STORAGE_*again. New: the recovery key's offline copy for forge-agent is in~/Documents/recovery_codes(the Mac's own disk); move it to real offline media.