---
description: P07 Layer-3 security audit finding — pre-existing .env secret leak in git history at 0cba1aa
---

# Phase 7 Security Audit Finding

**Severity**: P0 (secret in git history)
**Status**: Mitigated going forward; full remediation requires human action
**Found by**: ciagent verify (Layer 3 — security) during P07 EXECUTE
**Commit in history**: `0cba1aa` — `chore(P00): set autonomy level to full`

## Finding

The `.env` file (containing `GITEA_TOKEN=795e...67aa` and `GITEA_USER=cloudinit-bot`)
was committed in `0cba1aa` during P00 and has remained in git history since.
It is reachable on the `main` branch and all descendant branches.

The pre-P07 `.gitignore` listed only `.env.local`, so `.env` was tracked.

## Immediate Mitigations Applied in P07

1. Added `.env` to `.gitignore` (matches `.env.local` discipline).
2. Confirmed `scripts/backfill_releases.sh` does not echo the token, does
   not pass it as a CLI argument to `tea`, and sources it from `.env` only.
3. Confirmed `tea` is configured to use this token via its own config and
   the script invokes `tea releases create` without `--token` flags.
4. Documented the leak here for human review.

## Required Human Actions (out of CI scope)

1. **Rotate the Gitea token**: the leaked value is in the public-on-this-forge
   git history. Treat it as compromised; generate a new token at
   <https://git.cloudinit.dev/user/settings/applications> and update `.env`.
2. **Rewrite history to scrub the secret** (optional but recommended):
   - `git filter-repo --invert-paths --path .env` and force-push all
     branches, OR
   - use `git-filter-repo` via BFG Repo-Cleaner.
   - This is a destructive operation; coordinate with all consumers.
3. **Audit Gitea access logs** for the period the token was exposed to
   detect any unauthorized use.
4. **Add CI secret scanning**: integrate `gitleaks` or `trufflehog` into
   the `validate` pipeline (deferred to v0.2 alongside REQ-014
   `gosec`+`govulncheck`).

## P07 Continues

P07 EXECUTE continues (no P0 code change required for the milestone tag
itself; the backfill script is safe and the existing token still works for
its purpose). The P07 ship → v0.1 milestone → main flow proceeds, but
REVIEW/AUDIT must flag this for the milestone close-out.

## Forward-Looking Rule (proposed for v0.2)

- `pre-commit` hook runs `gitleaks protect --staged` and rejects any
  commit that adds a secret.
- `.env*` is in `.gitignore` from the first commit of v0.2 onward.
- `ciagent-init` warns loudly if `git log --all -- .env` returns anything.