dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(playbook): keyword grep is blind to unlabeled entropy — the reliable check is your own minted values

Browse Source 
A bare 32-hex key id matches none of the six credential keywords (verified). Added
an entropy scan and a PEM check as generic complements, marked the prefix list
repo-specific, and made the primary rule explicit: a gate that mints anything must
grep the commit for the literal values it produced.
This commit is contained in:
Joseph Doherty
2026-08-11 05:58:07 -04:00
parent 1cc4ccd258
commit 76098ffcd4
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin_ui_cleanup.md
+16 -1
View File
@@ -405,10 +405,25 @@ the only point at which it is cheap.
that is supposed to be there. So run both:
```bash
git diff --name-only <base>..<sha> # wrong-file
git diff --name-only <base>..<sha> # (a) wrong-file
git show <base>..<sha> | grep -inE '(api[_-]?key|password|secret|token|bearer|connectionstring)[\"'"'"' :=]+[A-Za-z0-9+/_-]{12,}'
git show <base>..<sha> | grep '^+' \
| grep -oE '[A-Fa-f0-9]{24,}|[A-Za-z0-9+/]{32,}={0,2}' | grep -v / # (c) unlabeled entropy
git show <base>..<sha> | grep -c 'BEGIN [A-Z ]*PRIVATE KEY\|BEGIN CERTIFICATE'
```
**(b) is keyword-anchored and therefore blind to unlabeled material** — a minted key id like a bare
32-hex string has no keyword near it and will not match; verified. Hence (c), and hence the PEM
check, since `-----BEGIN` is labeled but by none of those six words. The prefix list is also
**repo-specific and goes stale** (`otua_` is OtOpcUa's, `histgw_` HistorianGateway's) — extend it
per repo rather than treating the line as fixed.
**The reliable check is none of the above: if your verification gate MINTED anything — an API key,
a token, a test account — grep the commit for the literal values it produced.** Generic patterns
are a net for what you did not anticipate; the literal grep is the check for what you *did*, and
only it is dependable, because you know the exact string and nobody else does. A clean generic scan
is weak evidence when a gate minted credentials that the scan structurally cannot see.
Verified 2026-08-11 across this family: **`.claude/` is gitignored in OtOpcUa (`.gitignore:32`) and
HistorianGateway (`.gitignore:51`), but NOT in MxAccessGateway or ScadaBridge.** In those two the
enumerate-first discipline is the *only* thing between a "commit the sweep" instruction and local