[Security] HIGH: 35 issue(s) found in devforge #35

New issue

Closed

opened 2026-05-14 23:23:58 +00:00 by Mark · 2 comments

Mark commented 2026-05-14 23:23:58 +00:00

Owner

Copy link

Security Scan Results for devforge

Severity: HIGH
Findings: 35

1. secret_in_diff

• Details: Potential AWS Secret Key found in commit 0067370f
• Commit: 0067370f
• Pattern: AWS Secret Key

2. secret_in_diff

• Details: Potential AWS Secret Key found in commit f6d8aeb4
• Commit: f6d8aeb4
• Pattern: AWS Secret Key

3. secret_in_diff

• Details: Potential AWS Secret Key found in commit 1bfb09d4
• Commit: 1bfb09d4
• Pattern: AWS Secret Key

4. secret_in_diff

• Details: Potential AWS Secret Key found in commit f60f82e2
• Commit: f60f82e2
• Pattern: AWS Secret Key

5. secret_in_diff

• Details: Potential AWS Secret Key found in commit d6c8ac2b
• Commit: d6c8ac2b
• Pattern: AWS Secret Key

6. secret_in_diff

• Details: Potential AWS Secret Key found in commit 9a66bb6f
• Commit: 9a66bb6f
• Pattern: AWS Secret Key

7. secret_in_diff

• Details: Potential AWS Secret Key found in commit de6fa315
• Commit: de6fa315
• Pattern: AWS Secret Key

8. secret_in_diff

• Details: Potential AWS Secret Key found in commit 1456ca1f
• Commit: 1456ca1f
• Pattern: AWS Secret Key

9. secret_in_diff

• Details: Potential AWS Secret Key found in commit 0473ecc2
• Commit: 0473ecc2
• Pattern: AWS Secret Key

10. secret_in_diff

• Details: Potential AWS Secret Key found in commit 6b6ff415
• Commit: 6b6ff415
• Pattern: AWS Secret Key

11. secret_in_diff

• Details: Potential Password in URL found in commit cf9fb798
• Commit: cf9fb798
• Pattern: Password in URL

12. secret_in_diff

• Details: Potential Password in URL found in commit 3a2ec89b
• Commit: 3a2ec89b
• Pattern: Password in URL

13. secret_in_diff

• Details: Potential AWS Secret Key found in commit 3dfd6284
• Commit: 3dfd6284
• Pattern: AWS Secret Key

14. secret_in_diff

• Details: Potential AWS Secret Key found in commit 2f76ec99
• Commit: 2f76ec99
• Pattern: AWS Secret Key

15. secret_in_diff

• Details: Potential AWS Secret Key found in commit 97784b71
• Commit: 97784b71
• Pattern: AWS Secret Key

16. secret_in_diff

• Details: Potential Password in URL found in commit 72dcea07
• Commit: 72dcea07
• Pattern: Password in URL

17. secret_in_diff

• Details: Potential AWS Secret Key found in commit 8ee947ae
• Commit: 8ee947ae
• Pattern: AWS Secret Key

18. secret_in_diff

• Details: Potential AWS Secret Key found in commit 41e41e40
• Commit: 41e41e40
• Pattern: AWS Secret Key

19. secret_in_diff

• Details: Potential AWS Secret Key found in commit 8af27c74
• Commit: 8af27c74
• Pattern: AWS Secret Key

20. secret_in_diff

• Details: Potential AWS Secret Key found in commit e3be8f42
• Commit: e3be8f42
• Pattern: AWS Secret Key

21. secret_in_diff

• Details: Potential AWS Secret Key found in commit 6c550f3c
• Commit: 6c550f3c
• Pattern: AWS Secret Key

22. secret_in_diff

• Details: Potential AWS Secret Key found in commit 2ab54558
• Commit: 2ab54558
• Pattern: AWS Secret Key

23. secret_in_diff

• Details: Potential AWS Secret Key found in commit ce9e7197
• Commit: ce9e7197
• Pattern: AWS Secret Key

24. secret_in_diff

• Details: Potential AWS Secret Key found in commit e20d3a98
• Commit: e20d3a98
• Pattern: AWS Secret Key

25. secret_in_diff

• Details: Potential AWS Secret Key found in commit 71f28b59
• Commit: 71f28b59
• Pattern: AWS Secret Key

26. secret_in_diff

• Details: Potential AWS Secret Key found in commit bc907ad0
• Commit: bc907ad0
• Pattern: AWS Secret Key

27. secret_in_diff

• Details: Potential AWS Secret Key found in commit b1dd2128
• Commit: b1dd2128
• Pattern: AWS Secret Key

28. secret_in_diff

• Details: Potential AWS Secret Key found in commit b3567757
• Commit: b3567757
• Pattern: AWS Secret Key

29. secret_in_diff

• Details: Potential AWS Secret Key found in commit 413085da
• Commit: 413085da
• Pattern: AWS Secret Key

30. secret_in_diff

• Details: Potential Password in URL found in commit 6c0b2a5f
• Commit: 6c0b2a5f
• Pattern: Password in URL

31. secret_in_diff

• Details: Potential AWS Secret Key found in commit ff20e99e
• Commit: ff20e99e
• Pattern: AWS Secret Key

32. secret_in_diff

• Details: Potential AWS Secret Key found in commit 7f420012
• Commit: 7f420012
• Pattern: AWS Secret Key

33. secret_in_diff

• Details: Potential AWS Secret Key found in commit 2bbe9703
• Commit: 2bbe9703
• Pattern: AWS Secret Key

34. secret_in_diff

• Details: Potential Password in URL found in commit 867f9a98
• Commit: 867f9a98
• Pattern: Password in URL

35. secret_in_diff

• Details: Potential AWS Secret Key found in commit 935b82c2
• Commit: 935b82c2
• Pattern: AWS Secret Key

---

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `devforge` **Severity:** HIGH **Findings:** 35 ### 1. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 0067370f - **Commit:** `0067370f` - **Pattern:** `AWS Secret Key` ### 2. secret_in_diff - **Details:** Potential AWS Secret Key found in commit f6d8aeb4 - **Commit:** `f6d8aeb4` - **Pattern:** `AWS Secret Key` ### 3. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 1bfb09d4 - **Commit:** `1bfb09d4` - **Pattern:** `AWS Secret Key` ### 4. secret_in_diff - **Details:** Potential AWS Secret Key found in commit f60f82e2 - **Commit:** `f60f82e2` - **Pattern:** `AWS Secret Key` ### 5. secret_in_diff - **Details:** Potential AWS Secret Key found in commit d6c8ac2b - **Commit:** `d6c8ac2b` - **Pattern:** `AWS Secret Key` ### 6. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 9a66bb6f - **Commit:** `9a66bb6f` - **Pattern:** `AWS Secret Key` ### 7. secret_in_diff - **Details:** Potential AWS Secret Key found in commit de6fa315 - **Commit:** `de6fa315` - **Pattern:** `AWS Secret Key` ### 8. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 1456ca1f - **Commit:** `1456ca1f` - **Pattern:** `AWS Secret Key` ### 9. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 0473ecc2 - **Commit:** `0473ecc2` - **Pattern:** `AWS Secret Key` ### 10. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 6b6ff415 - **Commit:** `6b6ff415` - **Pattern:** `AWS Secret Key` ### 11. secret_in_diff - **Details:** Potential Password in URL found in commit cf9fb798 - **Commit:** `cf9fb798` - **Pattern:** `Password in URL` ### 12. secret_in_diff - **Details:** Potential Password in URL found in commit 3a2ec89b - **Commit:** `3a2ec89b` - **Pattern:** `Password in URL` ### 13. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 3dfd6284 - **Commit:** `3dfd6284` - **Pattern:** `AWS Secret Key` ### 14. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 2f76ec99 - **Commit:** `2f76ec99` - **Pattern:** `AWS Secret Key` ### 15. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 97784b71 - **Commit:** `97784b71` - **Pattern:** `AWS Secret Key` ### 16. secret_in_diff - **Details:** Potential Password in URL found in commit 72dcea07 - **Commit:** `72dcea07` - **Pattern:** `Password in URL` ### 17. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 8ee947ae - **Commit:** `8ee947ae` - **Pattern:** `AWS Secret Key` ### 18. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 41e41e40 - **Commit:** `41e41e40` - **Pattern:** `AWS Secret Key` ### 19. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 8af27c74 - **Commit:** `8af27c74` - **Pattern:** `AWS Secret Key` ### 20. secret_in_diff - **Details:** Potential AWS Secret Key found in commit e3be8f42 - **Commit:** `e3be8f42` - **Pattern:** `AWS Secret Key` ### 21. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 6c550f3c - **Commit:** `6c550f3c` - **Pattern:** `AWS Secret Key` ### 22. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 2ab54558 - **Commit:** `2ab54558` - **Pattern:** `AWS Secret Key` ### 23. secret_in_diff - **Details:** Potential AWS Secret Key found in commit ce9e7197 - **Commit:** `ce9e7197` - **Pattern:** `AWS Secret Key` ### 24. secret_in_diff - **Details:** Potential AWS Secret Key found in commit e20d3a98 - **Commit:** `e20d3a98` - **Pattern:** `AWS Secret Key` ### 25. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 71f28b59 - **Commit:** `71f28b59` - **Pattern:** `AWS Secret Key` ### 26. secret_in_diff - **Details:** Potential AWS Secret Key found in commit bc907ad0 - **Commit:** `bc907ad0` - **Pattern:** `AWS Secret Key` ### 27. secret_in_diff - **Details:** Potential AWS Secret Key found in commit b1dd2128 - **Commit:** `b1dd2128` - **Pattern:** `AWS Secret Key` ### 28. secret_in_diff - **Details:** Potential AWS Secret Key found in commit b3567757 - **Commit:** `b3567757` - **Pattern:** `AWS Secret Key` ### 29. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 413085da - **Commit:** `413085da` - **Pattern:** `AWS Secret Key` ### 30. secret_in_diff - **Details:** Potential Password in URL found in commit 6c0b2a5f - **Commit:** `6c0b2a5f` - **Pattern:** `Password in URL` ### 31. secret_in_diff - **Details:** Potential AWS Secret Key found in commit ff20e99e - **Commit:** `ff20e99e` - **Pattern:** `AWS Secret Key` ### 32. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 7f420012 - **Commit:** `7f420012` - **Pattern:** `AWS Secret Key` ### 33. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 2bbe9703 - **Commit:** `2bbe9703` - **Pattern:** `AWS Secret Key` ### 34. secret_in_diff - **Details:** Potential Password in URL found in commit 867f9a98 - **Commit:** `867f9a98` - **Pattern:** `Password in URL` ### 35. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 935b82c2 - **Commit:** `935b82c2` - **Pattern:** `AWS Secret Key` --- *This issue was auto-generated by the security sweep cron job.*

Mark added the

blocked:lint-failed

label 2026-05-15 20:58:20 +00:00

Mark added

blocked:verify-failed

and removed

blocked:lint-failed

labels 2026-05-20 19:54:10 +00:00

Mark commented 2026-05-20 23:07:14 +00:00

Author

Owner

Copy link

GSD VERIFY phase failed after 3 attempts.
═══ Gate: verify-passed (devforge#35) ═══
Mode: Tier 1 (functional only)

GATE OK: All gates up to 'implement' pass
── Tier 1: Functional ────────────────────────────────
Running tests...
❌ Tests failed (exit 1)
 FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > decodeTerminalMessage > should return empty Uint8Array for Blob input in sync decoder
 FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should return false when debug is not enabled
 FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should return true when debug is enabled
 FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should disable debug mode
ReferenceError: localStorage is not defined
 ❯ services/web/src/utils/terminalUtils.test.ts:12:5
 10|  beforeEach(() => {
 11|  vi.restoreAllMocks();
 12|  localStorage.clear();
 |  ^
 13|  });
 14| 

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/9]⎯

 Test Files  4 failed | 1 passed (5)
 Tests  6 failed | 4 passed (10)
 Start at  16:07:12
 Duration  669ms (transform 520ms, setup 0ms, import 141ms, tests 11ms, environment 1ms)
Running linter...
✅ Lint clean
⚠️ No type checker discovered
Previous test count: unknown

❌ GATE FAIL: verify-passed
- Tests failed with exit code 1
GATE FAIL: verify — blocked at 2026-05-20T23:07:14Z
Class: test-failure
Evidence: Verification failed: 1 failures
Git tag: devforge#35-gate-verify-fail-acd09c3a5917 (use gate-retry after fixing)

GSD VERIFY phase failed after 3 attempts. ═══ Gate: verify-passed (devforge#35) ═══ Mode: Tier 1 (functional only) GATE OK: All gates up to 'implement' pass ── Tier 1: Functional ──────────────────────────────── Running tests... ❌ Tests failed (exit 1)  FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > decodeTerminalMessage > should return empty Uint8Array for Blob input in sync decoder  FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should return false when debug is not enabled  FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should return true when debug is enabled  FAIL  services/web/src/utils/terminalUtils.test.ts > terminalUtils > debug mode > should disable debug mode ReferenceError: localStorage is not defined  ❯ services/web/src/utils/terminalUtils.test.ts:12:5  10|  beforeEach(() => {  11|  vi.restoreAllMocks();  12|  localStorage.clear();  |  ^  13|  });  14|  ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/9]⎯  Test Files  4 failed | 1 passed (5)  Tests  6 failed | 4 passed (10)  Start at  16:07:12  Duration  669ms (transform 520ms, setup 0ms, import 141ms, tests 11ms, environment 1ms) Running linter... ✅ Lint clean ⚠️ No type checker discovered Previous test count: unknown ❌ GATE FAIL: verify-passed - Tests failed with exit code 1 GATE FAIL: verify — blocked at 2026-05-20T23:07:14Z Class: test-failure Evidence: Verification failed: 1 failures Git tag: devforge#35-gate-verify-fail-acd09c3a5917 (use gate-retry after fixing)

Mark commented 2026-05-23 17:54:43 +00:00

Author

Owner

Copy link

Fixed: Purged secrets from git history using git-filter-repo:

• devforge-dev-key — dev API key (16 commits rewritten)
• wrong-key — test key in AGENTS.md (3 commits rewritten)
• your-api-key — doc placeholder, intentionally kept (false positive, usage example)

107 commits rewritten across main. Force push completed.

Fixed: Purged secrets from git history using git-filter-repo: - `devforge-dev-key` — dev API key (16 commits rewritten) - `wrong-key` — test key in AGENTS.md (3 commits rewritten) - `your-api-key` — doc placeholder, intentionally kept (false positive, usage example) 107 commits rewritten across main. Force push completed.

Mark closed this issue 2026-05-23 17:54:43 +00:00

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

No results found.

Labels

Clear labels   

blocked:gate-plan

  

blocked:gate-research

  

blocked:lint-failed

  

blocked:needs-attention

Issue requires human attention to resolve

  

blocked:needs-decision

  

blocked:no-changes

  

blocked:no-procedure

  

blocked:verify-failed

  

bug

Bug report

  

chore

Config / cleanup / ops housekeeping

  

feature-request

  

in-progress

  

needs-research

Ready for research pipeline

  

ops-task

Operations task — install, configure, deploy, API calls

  

quickfix

  

security/medium

Medium severity security issue

  

triage-approved

No labels

blocked:gate-plan

blocked:gate-research

blocked:lint-failed

blocked:needs-attention

blocked:needs-decision

blocked:no-changes

blocked:no-procedure

blocked:verify-failed

bug

chore

feature-request

in-progress

needs-research

ops-task

quickfix

security/medium

triage-approved

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Mark/devforge#35

No description provided.