HIGH: Secrets and internal network details committed in .env files in version control

Mark commented

2026-05-09 05:19:25 +00:00

Owner

Severity: High

Description

Multiple .env files with sensitive configuration are committed to version control, exposing secrets and internal network topology.

`backend/.env` exposed values:

OSINT_LLM_BASE_URL — points to internal Ollama LLM server (port 11434, private IP)
OSINT_DB_URL — SQLite database path
OSINT_CELERY_BROKER_URL — Redis broker URL (no auth)
OSINT_ADMIN_PASSWORD — adminadmin
OSINT_SECRET_KEY — dev-secret-key-change-in-production

`.env` exposed values:

JWT_SECRET — change-me-in-prod-min-32-chars-long
ADMIN_PASSWORD — adminadmin
OSINT_LLM_API_BASE_URL — internal LLM server
OSINT_BRAVE_API_KEY — empty (placeholder)
OSINT_SERPAPI_KEY — empty
OSINT_GOOGLE_CSE_KEY — empty
OSINT_GOOGLE_CSE_CX — empty

Impact

Internal network IP addresses exposed revealing network topology
Default JWT secret and admin password available to anyone with repo access
Redis connection details exposed (no password authentication)
LLM server endpoint without auth exposed

Recommendation

Remove .env files from git tracking (git rm --cached)
Add .env to .gitignore
Provide .env.example with dummy/placeholder values only
Rotate any secrets that may have been exposed

## Severity: High ## Description Multiple `.env` files with sensitive configuration are committed to version control, exposing secrets and internal network topology. ### `backend/.env` exposed values: - `OSINT_LLM_BASE_URL` — points to internal Ollama LLM server (port 11434, private IP) - `OSINT_DB_URL` — SQLite database path - `OSINT_CELERY_BROKER_URL` — Redis broker URL (no auth) - `OSINT_ADMIN_PASSWORD` — adminadmin - `OSINT_SECRET_KEY` — dev-secret-key-change-in-production ### `.env` exposed values: - `JWT_SECRET` — change-me-in-prod-min-32-chars-long - `ADMIN_PASSWORD` — adminadmin - `OSINT_LLM_API_BASE_URL` — internal LLM server - `OSINT_BRAVE_API_KEY` — empty (placeholder) - `OSINT_SERPAPI_KEY` — empty - `OSINT_GOOGLE_CSE_KEY` — empty - `OSINT_GOOGLE_CSE_CX` — empty ## Impact 1. Internal network IP addresses exposed revealing network topology 2. Default JWT secret and admin password available to anyone with repo access 3. Redis connection details exposed (no password authentication) 4. LLM server endpoint without auth exposed ## Recommendation 1. Remove .env files from git tracking (`git rm --cached`) 2. Add .env to `.gitignore` 3. Provide `.env.example` with dummy/placeholder values only 4. Rotate any secrets that may have been exposed

Mark added the

feature-request

label

2026-05-11 20:13:55 +00:00

Mark added the

triage-approved

label

2026-05-12 23:53:26 +00:00

Mark removed the

triage-approved

label

2026-05-14 00:15:08 +00:00

Mark added

quickfix

and removed

feature-request

labels

2026-05-20 22:21:58 +00:00

Mark added

triage-approved

and removed

quickfix

labels

2026-05-23 15:21:15 +00:00

Mark added

blocked:verify-failed

and removed

triage-approved

labels

2026-05-27 12:20:50 +00:00

Mark commented

2026-05-27 12:20:50 +00:00

Author

Owner

GSD VERIFY phase failed after 3 attempts.
═══ Gate: verify-passed (osint-hub#39) ═══
Mode: Tier 1 (functional only)

GATE OK: All gates up to 'implement' pass
── Tier 1: Functional ────────────────────────────────
Running tests...
❌ Tests failed (exit 4)
configfile: pyproject.toml
plugins: anyio-4.13.0, httpx-0.36.2, timeout-2.4.0, xdist-3.8.0, cov-7.1.0, split-0.11.0, asyncio-1.4.0
timeout: 60.0s
timeout method: signal
timeout func_only: False
asyncio: mode=Mode.STRICT, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function
collected 0 items

============================ no tests ran in 0.00s =============================
ERROR: file or directory not found: tests/

============================= test session starts ==============================
platform linux -- Python 3.11.14, pytest-9.0.3, pluggy-1.6.0
rootdir: /home/b/Projects/osint-hub
configfile: pyproject.toml
plugins: anyio-4.13.0, httpx-0.36.2, timeout-2.4.0, xdist-3.8.0, cov-7.1.0, split-0.11.0, asyncio-1.4.0
asyncio: mode=Mode.STRICT, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function
collected 0 items

============================ no tests ran in 0.00s =============================
Running linter...
✅ Lint clean
Running type checker...
✅ Types check clean
Previous test count: unknown

❌ GATE FAIL: verify-passed
- Tests failed with exit code 4
GATE FAIL: verify — blocked at 2026-05-27T12:20:49Z
Class: test-failure
Evidence: Verification failed: 1 failures
Git tag: osint-hub#39-gate-verify-fail-3b602df09c02 (use gate-retry after fixing)

GSD VERIFY phase failed after 3 attempts. ═══ Gate: verify-passed (osint-hub#39) ═══ Mode: Tier 1 (functional only) GATE OK: All gates up to 'implement' pass ── Tier 1: Functional ──────────────────────────────── Running tests... ❌ Tests failed (exit 4) configfile: pyproject.toml plugins: anyio-4.13.0, httpx-0.36.2, timeout-2.4.0, xdist-3.8.0, cov-7.1.0, split-0.11.0, asyncio-1.4.0 timeout: 60.0s timeout method: signal timeout func_only: False asyncio: mode=Mode.STRICT, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function collected 0 items ============================ no tests ran in 0.00s ============================= ERROR: file or directory not found: tests/ ============================= test session starts ============================== platform linux -- Python 3.11.14, pytest-9.0.3, pluggy-1.6.0 rootdir: /home/b/Projects/osint-hub configfile: pyproject.toml plugins: anyio-4.13.0, httpx-0.36.2, timeout-2.4.0, xdist-3.8.0, cov-7.1.0, split-0.11.0, asyncio-1.4.0 asyncio: mode=Mode.STRICT, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function collected 0 items ============================ no tests ran in 0.00s ============================= Running linter... ✅ Lint clean Running type checker... ✅ Types check clean Previous test count: unknown ❌ GATE FAIL: verify-passed - Tests failed with exit code 4 GATE FAIL: verify — blocked at 2026-05-27T12:20:49Z Class: test-failure Evidence: Verification failed: 1 failures Git tag: osint-hub#39-gate-verify-fail-3b602df09c02 (use gate-retry after fixing)

Mark added

triage-approved

quickfix

and removed

blocked:verify-failed

labels

2026-05-28 07:23:00 +00:00

Mark added the

in-progress

label

2026-06-03 21:00:05 +00:00

Mark commented