SYNCRO/.secrets-baseline.json at main · Calebux/SYNCRO · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
{
  "$comment": "Accepted secret-scan findings (issue #1082). Every entry here was reviewed and confirmed NOT to be a live credential. Adding an entry is a security decision — state why it is safe. Regenerate fingerprints with: node scripts/scan-secrets.js --all --update-baseline",
  "generatedAt": "2026-07-25",
  "findings": [
    {
      "fingerprint": "e2c0f2e10013037301d5a92af4d9b306",
      "file": ".github/workflows/database.yml",
      "rule": "jwt-token",
      "reason": "Supabase's published local-development demo token (iss: supabase-demo). Only valid against a localhost:54321 stack, not any hosted project."
    },
    {
      "fingerprint": "fa214831c20ab9394ff2ade97957e27e",
      "file": ".github/workflows/rls-audit.yml",
      "rule": "jwt-token",
      "reason": "Supabase local-development demo token, used as the fallback when SUPABASE_SERVICE_ROLE_KEY is unset. Localhost-only."
    },
    {
      "fingerprint": "e89d7186dd99bb10f4aaba6e66da74c4",
      "file": "scripts/test-rls-audit.js",
      "rule": "jwt-token",
      "reason": "Supabase local-development demo token used as a localhost fallback in the RLS audit test harness."
    },
    {
      "fingerprint": "0640eb5183b56630e7a3e5ba17607b8c",
      "file": "SECRET_HANDLING_ACTION_ITEMS.md",
      "rule": "jwt-token",
      "reason": "Documentation quoting the Supabase demo token while explaining secret-handling practice."
    },
    {
      "fingerprint": "3cc04cb0759d73947e737beea8c6e3c6",
      "file": "SECRET_HANDLING_AUDIT_REPORT.md",
      "rule": "jwt-token",
      "reason": "Audit report quoting the Supabase demo token as the subject of its finding."
    },
    {
      "fingerprint": "e2ad514ece24ace5cc43c1ba4ee2ec6c",
      "file": "SECRET_HANDLING_ACTION_ITEMS.md",
      "rule": "generic-assigned-secret",
      "reason": "Illustrative 'sk_live_abc123xyz' in a before/after code sample. Not a valid Stripe key."
    },
    {
      "fingerprint": "c60fc715568639cd97708ce199621414",
      "file": "backend/PII_REDACTION_README.md",
      "rule": "generic-assigned-secret",
      "reason": "Truncated 'sk_live_123...' in a doc example showing what the log redactor masks."
    },
    {
      "fingerprint": "de9e25a6472f58a393601577d1fb6c28",
      "file": "backend/tests/logger.test.ts",
      "rule": "stripe-secret-key",
      "reason": "Synthetic Stripe-shaped key. The test asserts the logger redacts it — a realistic shape is the point of the fixture."
    },
    {
      "fingerprint": "82e5880f79fd3421dcb9eef0e012159c",
      "file": "backend/tests/logger.test.ts",
      "rule": "generic-assigned-secret",
      "reason": "Same synthetic Stripe-shaped fixture, matched a second time by the generic rule."
    },
    {
      "fingerprint": "b2ab9f9f38d648a7f0c8aed5e9845c04",
      "file": "backend/tests/logger.test.ts",
      "rule": "generic-assigned-secret",
      "reason": "Fixture password used to assert the logger redacts password fields."
    },
    {
      "fingerprint": "16a01f192a7cb70965b9171f13649f0f",
      "file": "backend/tests/slack-service.test.ts",
      "rule": "slack-webhook",
      "reason": "Fake Slack webhook URL ending in /TEST, used against a mocked HTTP client."
    },
    {
      "fingerprint": "64457d724f6761d027c206985ce5c0fb",
      "file": "backend/tests/gmail-token-service.test.ts",
      "rule": "generic-assigned-secret",
      "reason": "Literal 'new-raw-access' fixture asserting token rotation. Not a real OAuth token."
    },
    {
      "fingerprint": "ddf6e92aa2ca2f7b448b1dfa63cf199d",
      "file": "backend/tests/smoke/smoke-tests.test.ts",
      "rule": "generic-assigned-secret",
      "reason": "Deliberately wrong password ('WrongPassword123!') used to assert an auth failure."
    },
    {
      "fingerprint": "46643341469ccce6c8d41e40abac936e",
      "file": "client/e2e/helpers.ts",
      "rule": "generic-assigned-secret",
      "reason": "Password for an ephemeral E2E test account created and torn down by the Playwright suite."
    }
  ]
}