dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 42 Pull Requests Actions Packages Projects Releases Wiki Activity

Rotate the exposed wonder-app-vd03 inbound API key and remove the local root credential files #74

New Issue
Open
opened 2026-11-06 15:24:46 -05:00 by dohertj2 · 1 comment
dohertj2 commented 2026-11-06 15:24:46 -05:00
Owner
Copy Link
Copy Source

Round-2 arch review P0 finding NF1 (High), PLAN-R2-08 Tasks 1 and 2, both marked needs-user and still pending in archreview/plans/PLAN-R2-08-conventions-hygiene.md.tasks.json.

  1. T1: rotate the exposed wonder-app-vd03 inbound API key via the dual-key flow (issue a new key, move clients, revoke the old one).
  2. T2: delete test.txt and triage the root credential files in the ScadaBridge checkout. They hold live credentials (contents not reproduced here).

Current state (2026-11-06): test.txt, sqllogin.txt and email_details.txt still exist in the local checkout root. They are gitignored and untracked, so the risk is local disclosure, not the remote. No rotation commit or deployment record was found. Verify T1 is still open; if the key was rotated outside the repo, close this with a note.

Source: archreview/plans/00-MASTER-TRACKER.md (Round-2 P0 item 1); archreview/plans/PLAN-R2-08-conventions-hygiene.md T1/T2

Round-2 arch review P0 finding NF1 (High), PLAN-R2-08 Tasks 1 and 2, both marked `needs-user` and still `pending` in `archreview/plans/PLAN-R2-08-conventions-hygiene.md.tasks.json`. 1. **T1:** rotate the exposed wonder-app-vd03 inbound API key via the dual-key flow (issue a new key, move clients, revoke the old one). 2. **T2:** delete `test.txt` and triage the root credential files in the ScadaBridge checkout. They hold live credentials (contents not reproduced here). **Current state (2026-11-06):** `test.txt`, `sqllogin.txt` and `email_details.txt` still exist in the local checkout root. They are gitignored and untracked, so the risk is local disclosure, not the remote. No rotation commit or deployment record was found. Verify T1 is still open; if the key was rotated outside the repo, close this with a note. Source: `archreview/plans/00-MASTER-TRACKER.md` (Round-2 P0 item 1); `archreview/plans/PLAN-R2-08-conventions-hygiene.md` T1/T2
dohertj2 added the type:review-findingpriority:p1migrated labels 2026-11-06 15:24:46 -05:00
dohertj2 commented 2026-11-06 15:43:49 -05:00
Author
Owner
Copy Link
Copy Source

Deferred 2026-11-06 (user): the rotation stays with the user, who will tell callers about the new key. Not to be done by an agent.

Deferred 2026-11-06 (user): the rotation stays with the user, who will tell callers about the new key. Not to be done by an agent.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
blocked
Blocked by dependency or external hold
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label migrated priority:p1 type:review-finding
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/ScadaBridge#74
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?