jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

feat(secrets): P6 agent guardrails and secret scanning #50

Merged
jfraeys merged 1 commit from jfraeys/feat/p6-agent-safety into main 2026-10-10 17:32:11 -04:00
Conversation 0 Commits 1 Files changed 9 +216
jfraeys commented 2026-10-10 17:21:19 -04:00
Owner
Copy link

P6 of the secrets plan.

  • `.claude/settings.json` deny rules: plaintext secret paths (Read/Grep/Glob/Edit) and decrypt commands (Bash). Tool permission only; shell can still bypass, so value-silent scripts remain the primary control.
  • gitleaks: `.githooks/pre-commit` (enabled by `./setup`) and `secret-scan.yml` over full history, with a redacted baseline of 2 existing findings.
  • `scripts/check-secret-hygiene.py`: no tracked .env/tfstate/plaintext vault; tracked `*.sops.yml` fully `ENC[...]`.
  • `scripts/CLAUDE.md` and a P6 section in `docs/secrets-management-sops.md`.

Tested: fake token staged -> gitleaks exit 1; tracked `.env.bak` / plaintext sops file -> hygiene exit 1; real tree passes.

Follow-up (R track, not fixed here): baseline covers a staging key in `staging-web.yml` (42033c6) and a `.env.example` finding (131451e) that need a human check.

🤖 Generated with Claude Code

P6 of the secrets plan. - \`.claude/settings.json\` deny rules: plaintext secret paths (Read/Grep/Glob/Edit) and decrypt commands (Bash). Tool permission only; shell can still bypass, so value-silent scripts remain the primary control. - gitleaks: \`.githooks/pre-commit\` (enabled by \`./setup\`) and \`secret-scan.yml\` over full history, with a redacted baseline of 2 existing findings. - \`scripts/check-secret-hygiene.py\`: no tracked .env/tfstate/plaintext vault; tracked \`*.sops.yml\` fully \`ENC[...]\`. - \`scripts/CLAUDE.md\` and a P6 section in \`docs/secrets-management-sops.md\`. Tested: fake token staged -> gitleaks exit 1; tracked \`.env.bak\` / plaintext sops file -> hygiene exit 1; real tree passes. Follow-up (R track, not fixed here): baseline covers a staging key in \`staging-web.yml\` (42033c6) and a \`.env.example\` finding (131451e) that need a human check. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat(secrets): P6 agent guardrails and secret scanning
All checks were successful
Lint / lint (pull_request) Successful in 2m8s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
a639550376
 
Claude deny rules for plaintext secret paths and decrypt commands,
gitleaks (staged pre-commit hook, full-history CI scan with a redacted
baseline of existing findings), and a structural check that tracked
SOPS files are fully encrypted and no .env/tfstate/plaintext vault is tracked.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!50
No description provided.