017f846ce2
The INCIDENT_LOG.md F1088 entry documented three production credentials that leaked via molecule-core PR #1098 (commit d513a0c) and were then INCLUDED IN PLAINTEXT in the documentation itself — the incident report became a secondary leak surface. Status of the three tokens (per the report's own Blast Radius table): - MiniMax (sk-cp-...KVw): revoked / endpoint inactive - GitHub PAT (github_pat_...hsIJLIL): revoked, confirmed 401 - Admin token (HlgeMb8...ShARE=): treated as active, rotation pending Even revoked tokens add noise to security audits and are findable via GitHub Code Search on the public docs repo. This PR replaces the full values with the short-suffix convention already in use in the same file's Blast Radius table, preserving the audit trail without the public-search surface. Side note: caught by Molecule-AI/molecule-core#2109's secret-scan workflow on PR #96 (the org-wide rollout that reused this same regex set caught its own first real find before the rollout PR even merged). The full values remain in molecule-core git history per F1088's explicit closure decision (no BFG scrub required); this PR doesn't change that. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| blog | ||
| docs | ||