Fail closed on weak Driver runtime credentials - #347
Merged
Conversation
Remove the retired resident-number test seed instead of preserving another secret path, and extend the existing redacted scanner for high-confidence generic password assignments.\n\nConstraint: Production runtime secrets remain outside Git and may not be printed or rotated by this commit.\nRejected: Add a new scanner dependency | the existing redacted scanner and GitGuardian already cover the required path.\nConfidence: high\nScope-risk: moderate\nDirective: Keep the explicit test-fixture allowlist narrow; do not weaken the 32-character Driver JWT gate.\nTested: 2117 delivery-api tests passed; Prisma generation, lint, typecheck, build, compose config, worktree/history secret scans, scanner regression, ignore hygiene, and git diff --check passed.\nNot-tested: The retired production SSM key was not deleted because that is a separate external secret-store mutation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs EVNSolution/clever-change-control#240
Summary
.worktrees/artifactsVerification
git diff --checkExternal follow-up
DSV_DRIVER_IDENTITY_SECRETkey from production secret storage under a separately authorized runtime change; this PR stops consuming or documenting it and does not print or mutate production secrets