[Security] HIGH: 5 issue(s) found in clawdeploy #7
Labels
No labels
blocked:gate-fetch
blocked:gate-fetch
blocked:needs-decision
blocked:no-changes
blocked:no-procedure
blocked:verify-failed
feature-request
in-progress
needs-triage
ops-task
quickfix
security/low
security/medium
triage-approved
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Mark/clawdeploy#7
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Security Scan Results for
clawdeploySeverity: HIGH
Findings: 5
1. secret_in_diff
20d7b79420d7b794AWS Secret Key2. secret_in_diff
16cc6c3916cc6c39AWS Secret Key3. secret_in_diff
7da09df17da09df1AWS Secret Key4. secret_in_diff
e3880e6be3880e6bAWS Secret Key5. secret_in_diff
17ff3f7d17ff3f7dAWS Secret KeyThis issue was auto-generated by the security sweep cron job.
Ops Pipeline — Not an Ops Task
This issue was labeled
ops-taskbut doesn't appear to be an operations task. It has been returned to feature triage for proper routing.Research analysis:
IS_OPS: NO
HOST: localhost
STATUS: NOT_OPS
EVIDENCE: The 5
secret_in_difffindings flag potential AWS Secret Keys leaked across benchmark-result commits (20d7b79,16cc6c3,7da09df,e3880e6,17ff3f7). These are benchmark scripts and result files — not infrastructure configs or deployment scripts. Remediating leaked secrets (git filter-branch/BFG purge, key rotation, force-push) is security incident response / codebase cleanup, not operations work as defined. The OPS definition covers installing, configuring, deploying, API calls, service management, infrastructure changes, backups, restores, SSH, cron jobs, or similar operational work — none of these apply here. The root issue is committed sensitive data, not a deployment or infrastructure problem.PROCEDURE: N/A — Not an ops task. Would require: (1) confirm each commit actually contains an AWS secret (read the diffs), (2) use
git filter-branchorgit filter-repo/BFG to purge secrets from history, (3) rotate the compromised AWS keFeature Triage Assessment
Scope: small
Risk: high
Spec Alignment: misaligned
Summary: 5 AWS secret keys are embedded in git history across 5 early benchmark commits (
20d7b79,16cc6c3,7da09df,e3880e6,17ff3f7) and must be purged from all historical blobs.Recommendation: Rotate the exposed AWS keys first (critical: you don't control past keys). Then use git-filter-repo to scrub secrets from all historical blobs. Force-push main only — but note this repo has an existing collaborator (Mark Whaite, who authored most commits), so coordinate the rewrite. Add AWS key patterns to .gitignore and install a pre-commit hook (talisman or gitleaks) to prevent recurrence. Do NOT merge anything else before this is resolved — secrets propagate to branches.
Rationale: scope=small: the operation is a single git-filter-repo invocation with no new code, tests, or modules. risk=high: git history rewriting is inherently destructive (breaks forks, clones, PRs) and the underlying AWS keys need active rotation in AWS itself before any repo fix matters. spec=misaligned: the project's implementation plan covers callback infrastructure and LLM config deployment — nothing about security hardening or git hygiene. Previous fix #9 (Docker security) was MEDIUM and also misaligned but was handled as out-of-band ops work.
Labeled
blocked:needs-decision— unblock on Forgejo to dispatch to the fixer pipeline.No longer reproducible — gitleaks scan shows 0 findings in current tree and git history. These were likely in old commits that have since been cleaned up or were false positives resolved by code changes.
Closing as resolved.