A live key was sitting in an unignored log; .bak files were unignored too - #56
Conversation
Found on the Mini while checking it for the hole claudeMB found on the MacBook. Different file, same shape. logs/start-all.out was untracked, unignored, and CONTAINED A LIVE xfb_ agent key. `*.log` did not cover it because start-all writes .out. In a clone of a public repo, one `git add -A` publishes it. Alongside it, 14 backup files were equally unignored. The existing `*.bak.*` rule requires a dot AFTER "bak", so it matches "foo.bak.1" and silently does not match plain "foo.bak" anywhere outside config/. The cp-before-edit habit that produced them is a good one - it is the ignore rules that did not match the names it actually produces. Verified against the real filenames rather than invented ones: every one of the 15 is now ignored, and src/, README.md, package.json and bin/ are confirmed still tracked. Deliberately appended rather than edited in place, leaving the existing config block untouched, so this does not collide with #55 (config/*.env). The two are independent and merge in either order. Third instance today of one defect shape: a rule written for one variant, correct for that variant, never extended to its neighbour. thinkoff_green fixed while thinkoff_green_light kept the dark value; config/*.json protecting .json but not .env; *.bak.* protecting foo.bak.1 but not foo.bak. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef69e97c35
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # A log is a plausible place for a key to land: the file that prompted this | ||
| # was logs/start-all.out on the Mini, which contained a live xfb_ agent key. | ||
| logs/ | ||
| *.out |
There was a problem hiding this comment.
When a contributor adds a legitimate .out artifact, such as an expected-output test fixture, this root-level wildcard silently excludes it from every directory. The preceding logs/ rule already covers the cited logs/start-all.out credential leak, and a repo-wide search found no other run-log location that requires ignoring all .out files, so this should be scoped to the log directory or the specific generated file.
Useful? React with 👍 / 👎.
2 participants
Found on the Mini while checking it for the hole #55 found on the MacBook. Different file, same shape.
A live key was in an untracked file
logs/start-all.outwas untracked, unignored, and contained a livexfb_agent key.*.logdid not cover it becausestart-allwrites.out. This is a clone of a public repo, so onegit add -Apublishes it.Alongside it, 14 backup files were equally unignored:
The existing
*.bak.*rule requires a dot afterbak. So it matchesfoo.bak.1and silently does not match plainfoo.bakanywhere outsideconfig/. The cp-before-edit habit that produced these is a good one — it is the ignore rules that never matched the names it actually produces.Verification
Tested against the real filenames found on disk, not invented ones. All 15 are now ignored:
README.md.bak*.bakscripts/claude-gui-wake.sh.bak_20260707*.bak_*src/actions.mjs.parallel-bak*-baksrc/confirmations.mjs.live-bak.20260621*-bak.*logs/start-all.outlogs/foo.bak.1*.bak.*(existing rule, still works)And confirmed not caught:
src/confirmations.mjs,README.md,package.json,bin/cli.mjs.Independent of #55
Deliberately appended rather than edited in place, leaving the existing config block untouched, so this does not collide with #55's
config/*.envinsertion. The two PRs are independent and merge in either order — verified by keeping my diff to pure additions at the end of the file.The pattern, three times in one day
This is the third instance of one defect shape: a rule written for one variant, correct for that variant, never extended to its neighbour.
thinkoff_greencorrected to a light value whilethinkoff_green_lightkept the dark one, across 21 call sites.config/*.jsonprotecting.jsonin that directory but not.env.*.bak.*protectingfoo.bak.1but notfoo.bak.In all three the original rule stayed correct, so nothing failed where anyone was looking. Worth a habit: when writing a rule that names a variant, ask what its siblings are called.
Not addressed here
scripts/claudemm-uik-daemon.shis untracked in the Mini clone and contains machine-specific paths. It should not live in this repo at all, but removing it is petrus's call and not a.gitignorematter.🤖 Generated with Claude Code