#8 - secrets.sh --built — the scan stops at the repository, and secrets ship in the bundle - null/Project-Template

null commented

2026-08-17 22:51:05 -05:00

Owner

secrets.sh scans the staged diff and, with --tracked, the tracked tree. Neither sees the compiled output, which is the artifact users actually receive. An auditor of AI-built apps reports finding hardcoded keys in the frontend bundle of seven of eight apps in a single week.

Add a --built

mode to the existing script rather than writing a new one: it already resolves SECRETS_PATTERN_FILE and holds the project's own credential shapes. Add the patterns that recur in shipped bundles -- eyJ (a JWT header), service_role, anon, apikey, Bearer -- and the VITE_, REACT_APP_ and NEXT_PUBLIC_ prefixes, which are listed even when benign because 'deliberately shipped to the browser' is worth seeing enumerated.

Verify: secrets.sh --built finds a planted fake credential in a scratch build directory and goes quiet once it is removed; docs/architecture/README.md records the new mode.

secrets.sh scans the staged diff and, with --tracked, the tracked tree. Neither sees the compiled output, which is the artifact users actually receive. An auditor of AI-built apps reports finding hardcoded keys in the frontend bundle of seven of eight apps in a single week. Add a --built <dir> mode to the existing script rather than writing a new one: it already resolves SECRETS_PATTERN_FILE and holds the project's own credential shapes. Add the patterns that recur in shipped bundles -- eyJ (a JWT header), service_role, anon, apikey, Bearer -- and the VITE_, REACT_APP_ and NEXT_PUBLIC_ prefixes, which are listed even when benign because 'deliberately shipped to the browser' is worth seeing enumerated. Verify: secrets.sh --built finds a planted fake credential in a scratch build directory and goes quiet once it is removed; docs/architecture/README.md records the new mode.

null added this to the Batch 01 — Production-readiness controls milestone 2026-08-17 22:51:05 -05:00

null added the

P1

label 2026-08-17 22:51:05 -05:00

null referenced this issue from a commit

2026-08-17 22:59:42 -05:00

feat(secrets): --built, because the repository is the wrong place to stop

null closed this issue

2026-08-17 22:59:42 -05:00

secrets.sh --built — the scan stops at the repository, and secrets ship in the bundle #8