Repository navigation
Redact home paths from this public repo, and add a test so it cannot recur - #178
Merged
Merged
Conversation
…recur This repository has been PUBLIC since it was created on 2026-06-17. How it happened, from the history: - 2026-07-25 — a launch-readiness change ran a scan for credential prefixes, /Users/<name> and 192.168., recorded "no matches", and closed the question. That scan was TRUE when it ran. - 2026-07-31 — cross_repo_test.go was added with real absolute paths as test fixtures. Six days after the scan. Test fixtures read as code, so it is exactly the content a scan-then-stop misses. - 2026-09-17 — an archived proposal carried two real worktree paths in its illustrative JSON. - Nothing re-checked for the following two months. Redacted (5 occurrences, 3 files): - cross_repo_test.go: the two fixtures now use /home/user/dev/..., matching the generic style already on the next line. The test exercises path-to-repo-name extraction, not these particular directories, so its intent is unchanged. - archive/2026-09-17-agent-topology-command/proposal.md: two illustrative paths in the work-item JSON. - archive/2026-07-25-launch-readiness/proposal.md: the scan record keeps what it searched for but writes the shape as /Users/<name>. Also adds TestNoPrivateDataInPublicRepo, run by `go test ./...` — which ci.yml already invokes, so it cannot be skipped by forgetting a step, and it fails locally too. It flags /Users/<lowercase-name>, RFC1918 dotted quads, and credential prefixes. Placeholders like /Users/<name> and prose such as "192.168." are not matched, so documentation can still describe the shape. The point is not the redaction, it is that a manual scan recorded as complete drifted within a week. A check that only runs when someone remembers is not a check. Confirmed the test fails against a re-introduced home path and against an injected ghp_ token. Full suite: 852 passed.
Deploying specsync with
|
| Latest commit: |
c0e3589
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://a2b4be4c.specsync.pages.dev |
| Branch Preview URL: | https://redact-home-paths.specsync.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repository has been public since it was created (2026-06-17). It accumulated real local paths and nothing re-checked for two months.
How it happened
Not carelessness in one place — a process that decays:
/Users/<name>and192.168., recorded "no matches", and closed the question. That scan was true when it ran.cross_repo_test.goadded with real absolute paths as test fixtures. Six days later. Fixtures read as code, which is exactly what a scan-then-stop misses.The scan was correct and the repo still leaked. That is the finding: a manual scan recorded as complete is not a check.
Redacted — 5 occurrences, 3 files
cross_repo_test.go— the two fixtures now use/home/user/dev/..., matching the generic style already on the next line. The test exercises path-to-repo-name extraction, not these particular directories, so its intent is unchanged and it still passes.archive/2026-09-17-agent-topology-command/proposal.md— two illustrative paths in the work-item JSON.archive/2026-07-25-launch-readiness/proposal.md— the scan record keeps what it searched for, writing the shape as/Users/<name>rather than the literal username.The durable part
TestNoPrivateDataInPublicRepo, run bygo test ./...— whichci.ymlalready invokes. So it cannot be skipped by forgetting a CI step, and it fails locally too.Flags
/Users/<lowercase-name>, RFC1918 dotted quads, and credential prefixes. Placeholders like/Users/<name>and prose such as"192.168."are deliberately not matched, so documentation can still describe the shape of a path.Confirmed it goes red against a re-introduced home path and against an injected
ghp_token. Full suite: 852 passed.Not done here, and it needs a decision
History still contains the paths. This rewrites the working tree only. Purging 2 months of history on a public repo is destructive and would break every PR reference and commit SHA anyone holds.
Worth weighing before doing it: the exposed material is a macOS username, four private repo names, and two worktree paths. No credentials and no private IP literals are in the history — I checked. So the sensitivity is low and the cost of a rewrite is high.
Your call. If you want it purged,
git filter-repois the right tool and it should be done as a deliberate, separately-communicated event rather than folded into a redaction PR.Unrelated but adjacent
ci.ymlruns onubuntu-latest, so this repository's CI is also currently blocked by the account-wide Actions billing failure. That is why the 852 tests above were run locally.