ciagent
b1b2e3dcb6
Layer-3 security audit during P07 EXECUTE found that .env (containing GITEA_TOKEN) was committed in0cba1aaduring P00 and remained in git history. The pre-P07 .gitignore only excluded .env.local, not .env. This commit: 1. Adds .env to .gitignore alongside .env.local (forward fix — prevents future re-tracking). 2. Documents the pre-existing leak in .ciagent/PHASE7_SECURITY_AUDIT.md with mitigation steps and required human actions (token rotation, history rewrite, access-log audit, CI secret scanning). The backfill script itself (commitde69788) does not leak the secret: it sources .env from disk and never echoes or passes it on the command line. The leak is upstream of P07 and is documented as P0 for the human to remediate out-of-band. ---ci--- project: orca phase: 7 milestone: v0.1 status: execute version: v0.1.7 requirements: covered: [REQ-007] partial: [] ---/ci---
14 lines
107 B
Plaintext
14 lines
107 B
Plaintext
bin/
|
|
coverage.out
|
|
*.test
|
|
*.out
|
|
.DS_Store
|
|
orca
|
|
*.db
|
|
*.db-journal
|
|
*.db-wal
|
|
*.db-shm
|
|
.env
|
|
.env.local
|
|
*.tar.gz
|