From cff06439faa7123c7d2b9a697578c64205e3e177 Mon Sep 17 00:00:00 2001 From: dtzp555-max Date: Wed, 22 Apr 2026 11:40:50 +1000 Subject: [PATCH] chore(privacy): remediation follow-up from ocp#44 (#45) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three-part follow-up from the 2026-04-22 privacy postmortem: 1. OAUTH_CLIENT_ID verified as public Claude Code constant (not a secret). Added gitleaks allowlist entry. The value 9d1c250a-e61b-44d9-88ed-5944d1962f5e is the public PKCE client ID used by the Claude Code CLI — public clients in PKCE flows have no client secret, so the ID itself carries no secret value. Introduced in commit b87992f (the 2026-04-11 drift incident); the constant mirrors what cli.js embeds for its OAuth token-refresh flow. 2. README.md API key example made clearly fake (ocp_example12345abcde...) to avoid gitleaks false-positives and clarify to readers it is not real. The ocp_ prefix IS the real prefix (keys.mjs line 80: randomBytes(24).base64url), so the prior example could be mistaken for a real truncated key. 3. PR template: added Privacy self-check section for PUBLIC repos below the existing 5.3 user-visible change self-check section. 4. .gitleaks.toml: new file with allowlist for the three confirmed non-issues (OAUTH_CLIENT_ID constant, README placeholder regex, old plan doc path). No code or behavior change beyond the docs, README, and new config file. Closes part of ocp#44. Co-authored-by: Tao Deng Co-authored-by: Claude Sonnet 4.6 --- .github/PULL_REQUEST_TEMPLATE.md | 9 +++++++++ .gitleaks.toml | 14 ++++++++++++++ README.md | 2 +- 3 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 .gitleaks.toml diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index a8395b9..921a382 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -45,3 +45,12 @@ Reviewers: this section is for you, not the author. Do not approve until every b - [ ] This PR has no user-visible changes → stated "no user-visible change" in summary above Reviewers: if "user-visible" is checked but README diff is empty, block merge (per 5.3 reviewer gate). + +### Privacy self-check (for PUBLIC repos) — Iron Rule adjacent + +- [ ] This PR does not introduce real names, nicknames, or handles that identify specific individuals. All references use role-based terms (`project maintainer`, `contributor`, `user`, `reviewer`). +- [ ] This PR does not introduce literal personal paths (`/Users//`, `/home//`). Uses `$HOME/` or `~/` instead. +- [ ] This PR does not introduce personal machine hostnames. Uses role-based names or generic descriptors. +- [ ] This PR does not introduce personal email addresses beyond automated placeholders like `noreply@.com`. + +Reviewers: if any of the above is violated and the repo is PUBLIC, block merge and request scrub. diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000..96679b2 --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,14 @@ +title = "OCP gitleaks configuration" + +[allowlist] +description = "OCP known-safe allowlist" +regexes = [ + # Public OAuth client ID for Claude Code PKCE flow (constant, not a secret) + '''9d1c250a-e61b-44d9-88ed-5944d1962f5e''', + # OCP README API key placeholder example + '''ocp_(example|XXX+|xxxx+)''', +] +paths = [ + # Old plan doc with test-admin-123 placeholders + '''docs/superpowers/plans/2026-04-10-lan-mode\.md''', +] diff --git a/README.md b/README.md index 63fafb1..95b2d22 100644 --- a/README.md +++ b/README.md @@ -83,7 +83,7 @@ export OCP_ADMIN_KEY=your-secret-admin-key ocp keys add wife-laptop # ✓ Key created for "wife-laptop" -# API Key: ocp_xDYzOB9ZKYzn... +# API Key: ocp_example12345abcde... # Copy this key now — you won't see it again. ocp keys add son-ipad