fix(security): remove leaked Forgejo credential and stray Python artifacts #695

Merged

binjovi-bot merged 1 commit from fix/remove-leaked-credential-artifacts into trunk 2026-09-13 07:36:34 +00:00

Conversation 0 Commits 1 Files changed 14 +12 -386

sean commented 2026-09-13 07:34:11 +00:00

Owner

Copy link

An earlier commit (542469a3) swept a git-credential-fill output file (cred.txt, containing a live Forgejo token) into the tree alongside scratch Python scripts (api.py, logs.py, open_pr.py, and friends) used to drive Forgejo/Binjovi from the command line. Both violate this repo's own rules: never commit secrets, and never use Python here.

The leaked token has already been rotated (make forgejo-cred). This PR only removes the tracked artifacts and hardens .gitignore against the same failure mode (cred.txt/cred.in, __pycache__/*.pyc, *.out) so a future broad git add can't reintroduce them.

tests/binjovi.sh, the guard covering the same manifests these stray files landed alongside, still passes unchanged.

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

An earlier commit (542469a3) swept a git-credential-fill output file (cred.txt, containing a live Forgejo token) into the tree alongside scratch Python scripts (api.py, logs.py, open_pr.py, and friends) used to drive Forgejo/Binjovi from the command line. Both violate this repo's own rules: never commit secrets, and never use Python here. The leaked token has already been rotated (`make forgejo-cred`). This PR only removes the tracked artifacts and hardens `.gitignore` against the same failure mode (`cred.txt`/`cred.in`, `__pycache__/*.pyc`, `*.out`) so a future broad `git add` can't reintroduce them. `tests/binjovi.sh`, the guard covering the same manifests these stray files landed alongside, still passes unchanged. https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

sean added 1 commit 2026-09-13 07:34:11 +00:00

fix(security): remove leaked Forgejo credential and stray Python artifacts ... 85e82b1c7a

An earlier commit (542469a3) swept a git-credential-fill output file
(cred.txt, containing a live Forgejo token) into the tree alongside
scratch Python scripts (api.py, logs.py, open_pr.py, and friends) used
to drive Forgejo/Binjovi from the command line. Both violate this
repo's own rules: never commit secrets, and never use Python here.

The leaked token has already been rotated (make forgejo-cred). This
commit only removes the tracked artifacts and hardens .gitignore
against the same failure mode (cred.txt/cred.in, __pycache__/*.pyc,
*.out) so a future broad `git add` can't reintroduce them.

tests/binjovi.sh, the guard covering the same manifests these stray
files landed alongside, still passes unchanged.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

binjovi-bot merged commit 85e82b1c7a into trunk 2026-09-13 07:36:34 +00:00

binjovi-bot deleted branch fix/remove-leaked-credential-artifacts 2026-09-13 07:36:35 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!695

No description provided.