mirror of
https://github.com/dtzp555-max/ocp.git
synced 2026-07-21 21:15:09 +00:00
cff06439fa
Three-part follow-up from the 2026-04-22 privacy postmortem:
1. OAUTH_CLIENT_ID verified as public Claude Code constant (not a secret).
Added gitleaks allowlist entry. The value 9d1c250a-e61b-44d9-88ed-5944d1962f5e
is the public PKCE client ID used by the Claude Code CLI — public clients in
PKCE flows have no client secret, so the ID itself carries no secret value.
Introduced in commit b87992f (the 2026-04-11 drift incident); the constant
mirrors what cli.js embeds for its OAuth token-refresh flow.
2. README.md API key example made clearly fake (ocp_example12345abcde...) to
avoid gitleaks false-positives and clarify to readers it is not real.
The ocp_ prefix IS the real prefix (keys.mjs line 80: randomBytes(24).base64url),
so the prior example could be mistaken for a real truncated key.
3. PR template: added Privacy self-check section for PUBLIC repos below the
existing 5.3 user-visible change self-check section.
4. .gitleaks.toml: new file with allowlist for the three confirmed non-issues
(OAUTH_CLIENT_ID constant, README placeholder regex, old plan doc path).
No code or behavior change beyond the docs, README, and new config file.
Closes part of ocp#44.
Co-authored-by: Tao Deng <dtzp555@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
15 lines
424 B
TOML
15 lines
424 B
TOML
title = "OCP gitleaks configuration"
|
|
|
|
[allowlist]
|
|
description = "OCP known-safe allowlist"
|
|
regexes = [
|
|
# Public OAuth client ID for Claude Code PKCE flow (constant, not a secret)
|
|
'''9d1c250a-e61b-44d9-88ed-5944d1962f5e''',
|
|
# OCP README API key placeholder example
|
|
'''ocp_(example|XXX+|xxxx+)''',
|
|
]
|
|
paths = [
|
|
# Old plan doc with test-admin-123 placeholders
|
|
'''docs/superpowers/plans/2026-04-10-lan-mode\.md''',
|
|
]
|