v0.1.0

Changelog

• 37207ff: gofmt assisted_test.go (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• f98813c: README: Infisical in tested table (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• b7229eb: infisical-secret sink and infisical:// reference scheme (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• f338958: Merge branch 'fix/cli' into integration (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 01bfcf5: Merge branch 'fix/conn' into integration (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 16da03f: assisted prompt: read pasted PEM blocks to the END line, flush leftover TTY input, ask only for fields a person supplies (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• c517013: serve: test that a short webhook secret stops serve at startup (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 6df68d8: serve: auto-rotate the resolved credential in the background, once per incident (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 5827e5e: Create-revoke failure path finishes promoted sinks (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 7bebbc0: Run abort's rollback on a detached context with a 2 minute bound (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• ce494e1: Drain: a failed describe restarts the quiet period (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 1f7d687: Postgres integration test: a stale stamp on the standby does not redirect Create onto the live role (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• fbbd1d6: breach run: rotate credentials still draining from an earlier run after the gate instead of reporting success (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 66fc3bb: breach run: --yes no longer answers the containment question or host-clean gate without --check-cmd (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• aff9508: webhook: refuse an empty or short webhook secret instead of using it as the HMAC key (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• bc9ed92: Treat a refused revoke of the new key as final in rollback (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 99b6ba6: Rollback revokes the new key only after every sink is restored (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 35d21d5: awsssm: refuse an existing non-SecureString parameter before writing (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 6560441: sources: refuse plain-http base URLs except to loopback hosts (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 104e58b: blast: skip FIFOs and devices at known credential paths instead of blocking on open (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 3d7ad42: Refuse a minted key equal to the current ID; Postgres picks the standby from the engine's record (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 3e0d7b3: cloudflare: verify a user-owned admin token when account_id is set (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 28dfed5: vercel: treat a variable the decrypt endpoint does not return as hidden (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 3d6a96b: githubactions: keep an existing org secret's visibility and repositories on overwrite (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• a08729e: gitlabci: keep an existing variable's attributes on update (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 399b003: Add README, example policy, CONTRIBUTING; bump staticcheck; check/plan show approval vs blocked (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 48251e5: Add live GitHub deploy-key test (real SSH proof of new key live, old key dead) (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• ea39755: Add Docker integration and CLI end-to-end test; engine read-only mode; fix sink Finish after commit (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• d423a80: Wire CLI; engine calls sink Finish, passes run_id, stops retrying manual restores; drop duplicate declarative cloudflare (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• ec2a468: Merge branch 'lane/intake' into integration (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 6e49ed2: Merge lane/sinks (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• ec1f970: Merge lane/sources (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 3a27e6d: Merge branch 'lane/engine' into integration (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 7bba87b: CLI: terminal prompter, connectors table (wip) (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 59f50c7: Register all sources and document them (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• bcddd10: Add assisted sources: npm, PyPI, GitHub PAT, Anthropic, Stripe (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 0dfabc5: Add postgres-password and mysql-password sources (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• fc25e6f: Add aws-iam-access-key source (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• bf82c7e: Add HTTP source connectors: Cloudflare, Datadog, OpenAI, GitHub (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 7eb4db4: docs: sink reference and declarative connector format v1 (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 2ee870f: declarative: probe twilio keys with a resource standard keys can read (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• d3946d7: sinks: resolve vault token per operation; tidy modules (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• c8700b8: declarative: YAML connector format, interpreter and catalog (sendgrid, twilio, cloudflare) (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 4f126f6: Add scheduler: unattended rotation for certified, incidents for the rest (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 12d1cde: Add rotation engine: plan, rotate, drain, revoke, rollback, resume (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• f3f2e1c: Add hash-chained audit log, verification and evidence export (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 73bcc11: Add file-backed state store with lock, incidents and fingerprint index (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 544a8d8: Add in-memory fake source, sink and clock for tests and demos (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 4d05ef4: Add breach mode docs (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• b274f3b: Add HTTP server: status page, JSON status API, GitHub webhook route (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 4986b95: secretref: vault:// and aws-sm:// resolvers (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 5d0c1d8: sinks: github-actions-secret, gitlab-ci-variable and vercel-env sinks (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 629d461: Add breach-mode planner, npm-worm-ci runbook and host-clean gate (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• a05868c: sinks: aws-secrets-manager and aws-ssm-parameter sinks (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 0c44cbd: sinks: vault-kv sink and KV v2 client (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 075fcb3: sinks: shared sink kit and dotenv sink (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 97fb713: Add scanner report parsers, incident router and GitHub webhook (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• a5afed2: Add blast-radius host scan (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 2f20a32: Add finding type and credential detectors (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 2fb86a4: Add CI, signed release pipeline, NOTICE, SECURITY.md (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 717bca5: Add ports: incidents, fingerprint index, status (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)
• 0afc122: Skeleton: connector contracts, secret, secretref, fingerprint, policy (Krishnatejaswi S shentharkrishnatejaswi@gmail.com)