From 76098ffcd4462fdacd0600cddec79d18b54a8210 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 11 Aug 2026 05:58:07 -0400 Subject: [PATCH] =?UTF-8?q?docs(playbook):=20keyword=20grep=20is=20blind?= =?UTF-8?q?=20to=20unlabeled=20entropy=20=E2=80=94=20the=20reliable=20chec?= =?UTF-8?q?k=20is=20your=20own=20minted=20values?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A bare 32-hex key id matches none of the six credential keywords (verified). Added an entropy scan and a PEM check as generic complements, marked the prefix list repo-specific, and made the primary rule explicit: a gate that mints anything must grep the commit for the literal values it produced. --- admin_ui_cleanup.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/admin_ui_cleanup.md b/admin_ui_cleanup.md index 95ff8ed..c64e9df 100644 --- a/admin_ui_cleanup.md +++ b/admin_ui_cleanup.md @@ -405,10 +405,25 @@ the only point at which it is cheap. that is supposed to be there. So run both: ```bash - git diff --name-only .. # wrong-file + git diff --name-only .. # (a) wrong-file git show .. | grep -inE '(api[_-]?key|password|secret|token|bearer|connectionstring)[\"'"'"' :=]+[A-Za-z0-9+/_-]{12,}' + git show .. | grep '^+' \ + | grep -oE '[A-Fa-f0-9]{24,}|[A-Za-z0-9+/]{32,}={0,2}' | grep -v / # (c) unlabeled entropy + git show .. | grep -c 'BEGIN [A-Z ]*PRIVATE KEY\|BEGIN CERTIFICATE' ``` + **(b) is keyword-anchored and therefore blind to unlabeled material** — a minted key id like a bare + 32-hex string has no keyword near it and will not match; verified. Hence (c), and hence the PEM + check, since `-----BEGIN` is labeled but by none of those six words. The prefix list is also + **repo-specific and goes stale** (`otua_` is OtOpcUa's, `histgw_` HistorianGateway's) — extend it + per repo rather than treating the line as fixed. + + **The reliable check is none of the above: if your verification gate MINTED anything — an API key, + a token, a test account — grep the commit for the literal values it produced.** Generic patterns + are a net for what you did not anticipate; the literal grep is the check for what you *did*, and + only it is dependable, because you know the exact string and nobody else does. A clean generic scan + is weak evidence when a gate minted credentials that the scan structurally cannot see. + Verified 2026-08-11 across this family: **`.claude/` is gitignored in OtOpcUa (`.gitignore:32`) and HistorianGateway (`.gitignore:51`), but NOT in MxAccessGateway or ScadaBridge.** In those two the enumerate-first discipline is the *only* thing between a "commit the sweep" instruction and local