1 line
5.2 KiB
JSON
1 line
5.2 KiB
JSON
{"repo": "andrewaltimit/agentsocial", "files": {".secrets.yaml": {"cf4f146919b3b844db9fa5cdf11215a442cede13": {"t": 1785674469.8667374, "n": 4786, "h": "ba837f72db4ae6bb", "c": "# Secrets Configuration for Automatic Masking\n# This configuration ensures secrets are never exposed in public GitHub comments\n# Used by all AI agents and automation tools\n\nversion: \"1.0.0\"\ndescription: \"Central configuration for automatic secret masking in public outputs\"\n\n# Environment variables that contain secrets\n# These will be masked if their values appear in any GitHub comment\nenvironment_variables:\n # GitHub tokens and authentication\n - GITHUB_TOKEN\n - GH_TOKEN\n - AI_AGENT_TOKEN\n\n # API keys for various services\n - OPENROUTER_API_KEY\n - ANTHROPIC_API_KEY\n - OPENAI_API_KEY\n - GEMINI_API_KEY\n - CLAUDE_API_KEY\n\n # Database passwords\n - DB_PASSWORD\n - DATABASE_PASSWORD\n - POSTGRES_PASSWORD\n - MYSQL_PASSWORD\n - REDIS_PASSWORD\n\n # Application secrets\n - SECRET_KEY\n - JWT_SECRET\n - SESSION_SECRET\n - WEBHOOK_SECRET\n - WEBHOOK_URL\n\n # Cloud provider credentials\n - AWS_ACCESS_KEY_ID\n - AWS_SECRET_ACCESS_KEY\n - AWS_SESSION_TOKEN\n - GOOGLE_API_KEY\n - GOOGLE_CLIENT_SECRET\n - AZURE_CLIENT_SECRET\n\n # Container registry credentials\n - DOCKER_PASSWORD\n - DOCKER_HUB_PASSWORD\n\n # Package registry tokens\n - NPM_TOKEN\n - PYPI_TOKEN\n\n # Communication service tokens\n - SLACK_TOKEN\n - SLACK_WEBHOOK_URL\n - DISCORD_TOKEN\n - DISCORD_WEBHOOK_URL\n - TELEGRAM_BOT_TOKEN\n\n # Payment service keys\n - STRIPE_SECRET_KEY\n - STRIPE_WEBHOOK_SECRET\n - PAYPAL_CLIENT_SECRET\n\n # Email service keys\n - SENDGRID_API_KEY\n - MAILGUN_API_KEY\n - TWILIO_AUTH_TOKEN\n\n # Cryptographic keys\n - SSH_PRIVATE_KEY\n - GPG_PRIVATE_KEY\n - ENCRYPTION_KEY\n\n # Generic secrets\n - API_SECRET\n - CLIENT_SECRET\n - PRIVATE_KEY\n - ACCESS_TOKEN\n - REFRESH_TOKEN\n - BEARER_TOKEN\n - AUTH_TOKEN\n\n # Service URLs (may contain embedded credentials)\n - COMFYUI_SERVER_URL\n - AI_TOOLKIT_SERVER_URL\n - GAEA2_REMOTE_URL\n\n# Patterns for detecting secrets by format\n# These regex patterns identify common secret formats\npatterns:\n - name: GITHUB_TOKEN\n pattern: \"ghp_[A-Za-z0-9_]{36,}\"\n description: \"GitHub personal access token\"\n\n - name: GITHUB_SECRET\n pattern: \"ghs_[A-Za-z0-9_]{36,}\"\n description: \"GitHub secret\"\n\n - name: GITHUB_PAT\n pattern: \"github_pat_[A-Za-z0-9_]{22,}\"\n description: \"GitHub personal access token (new format)\"\n\n - name: GITHUB_OAUTH\n pattern: \"gho_[A-Za-z0-9_]{36,}\"\n description: \"GitHub OAuth token\"\n\n - name: API_KEY\n pattern: \"sk-[A-Za-z0-9\\\\-]{32,}\"\n description: \"Generic API key (OpenAI style)\"\n\n - name: PRIVATE_KEY\n pattern: \"pk-[A-Za-z0-9\\\\-]{32,}\"\n description: \"Generic private key\"\n\n - name: BEARER_TOKEN\n pattern: \"Bearer\\\\s+[A-Za-z0-9\\\\-_=]{20,}\"\n description: \"Bearer authentication token\"\n\n - name: URL_WITH_AUTH\n pattern: \"https?://[^:\\\\s]+:[^@\\\\s]+@[^\\\\s]+\"\n description: \"URL with embedded credentials\"\n\n - name: AWS_ACCESS_KEY\n pattern: \"AKIA[0-9A-Z]{16}\"\n description: \"AWS access key ID\"\n\n - name: JWT_TOKEN\n pattern: \"eyJ[A-Za-z0-9\\\\-_=]+\\\\.[A-Za-z0-9\\\\-_=]+\\\\.[A-Za-z0-9\\\\-_=]+\"\n description: \"JSON Web Token\"\n\n - name: PRIVATE_KEY_BLOCK\n pattern: \"-----BEGIN[A-Z\\\\s]+PRIVATE KEY-----[\\\\s\\\\S]+?-----END[A-Z\\\\s]+PRIVATE KEY-----\"\n description: \"Private key block (RSA, EC, etc.)\"\n\n - name: SSH_KEY\n pattern: \"ssh-rsa\\\\s+[A-Za-z0-9+/]{100,}\"\n description: \"SSH public key\"\n\n - name: SLACK_TOKEN\n pattern: \"xox[baprs]-[0-9]{10,}-[A-Za-z0-9]{24,}\"\n description: \"Slack token\"\n\n - name: STRIPE_KEY\n pattern: \"(sk|pk)_(test|live)_[A-Za-z0-9]{24,}\"\n description: \"Stripe API key\"\n\n - name: NPM_TOKEN\n pattern: \"npm_[A-Za-z0-9]{36}\"\n description: \"NPM access token\"\n\n# Auto-detection rules for environment variables\nauto_detection:\n enabled: true\n\n # Patterns that indicate a variable contains secrets\n # Uses glob-style patterns (* = any characters)\n include_patterns:\n - \"*_TOKEN\"\n - \"*_SECRET\"\n - \"*_KEY\"\n - \"*_PASSWORD\"\n - \"*_PASS\"\n - \"*_PWD\"\n - \"*_CREDENTIAL*\"\n - \"*_AUTH\"\n - \"TOKEN_*\"\n - \"SECRET_*\"\n - \"KEY_*\"\n - \"PASSWORD_*\"\n - \"API_*\"\n - \"PRIVATE_*\"\n\n # Patterns to exclude from auto-detection\n # These are typically safe to expose\n exclude_patterns:\n - \"PUBLIC_KEY\"\n - \"PUBLIC_*\"\n - \"*_PUBLIC\"\n - \"*_PUBLIC_*\"\n - \"ENABLE_*\"\n - \"*_ENABLED\"\n - \"*_DISABLED\"\n\n# Settings for the masking behavior\nsettings:\n # Minimum length for a value to be considered a secret\n minimum_secret_length: 4\n\n # Whether pattern matching is case-sensitive\n case_sensitive_patterns: false\n\n # Whether to mask partial matches\n mask_partial_matches: false\n\n # Whether to log when secrets are masked (to stderr)\n log_masked_secrets: true\n\n # Format for masked values\n # {name} will be replaced with the variable/pattern name\n mask_format: \"[MASKED_{name}]\"\n"}}}} |