fix(security): remove the hardcoded Cloudflare token — use wrangler OAuth - #32
Conversation
…Auth deploy-repos.sh exported a live CLOUDFLARE_API_TOKEN on line 5, in a PUBLIC repository, and in git history. THE TOKEN WAS NEVER NECESSARY. This is a local developer script — it runs wrangler against $HOME/Documents/hyperpolymath-repos, not in CI. `wrangler login` (OAuth) covers it completely: the session lives in ~/.config/.wrangler/, no long-lived credential exists, and it is revocable from the dashboard. The token existed because `export TOKEN=...` needs no setup step and OAuth needs one. The cheapest option at authoring time became a published credential. So this deletes rather than relocates it. There is nothing to move to a secret store, because nothing needs a secret. The account id on the next line is KEPT and is not a secret: Cloudflare treats it as an ordinary identifier and it appears in dashboard URLs. It earns its place because this login can see more than one account. A comment now says so, so nobody "tidies" it into a secret and nobody reintroduces the token beside it. Also switched `deno run -A npm:wrangler` to `bunx wrangler`, per the Bun-over-Deno ruling. Both runtimes are installed; this is a one-word change. Added .gitleaks.toml for the four remaining findings, all benign: deno.lock integrity hashes, two setup docs describing where a bot token goes, and an example carrying the literal `.token = "abc123def456..."` next to the comment `// Would be real token`. The exclusions are deliberately narrow and NOTHING in source or scripts is suppressed. VERIFIED in both directions: findings go to 0, and re-introducing a token into deploy-repos.sh is still caught. An allowlist that reopened the hole this repository just had would be worse than no scanner. ⚠ THE EXPOSED TOKEN MUST STILL BE REVOKED. It has been public; removing it from the file does not un-publish it. Dashboard → My Profile → API Tokens. No replacement is needed once wrangler login is done. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRemoves the hardcoded Cloudflare API token from the deployment script in favor of wrangler OAuth authentication, and updates the runner command from Deno to Bun. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
1 participant
deploy-repos.shexported a liveCLOUDFLARE_API_TOKENon line 5, in a public repository, and in git history.The token was never necessary
This is a local developer script — it runs wrangler against
$HOME/Documents/hyperpolymath-repos, not in CI.wrangler login(OAuth) covers it completely: the session lives in~/.config/.wrangler/, no long-lived credential exists at all, and it is revocable from the dashboard.The token existed because
export TOKEN=…needs no setup step and OAuth needs one. The cheapest option at authoring time became a published credential — and it survived because nothing scanned this repository until yesterday.So this deletes rather than relocates it. There is nothing to move into a secret store, because nothing needs a secret.
What is kept, and why
The account id is not a secret. Cloudflare treats it as an ordinary identifier and it appears in dashboard URLs. It earns its place because this login can see more than one account. A comment now says so — so nobody "tidies" it into a secret store, and nobody reintroduces the token beside it.
Also switched
deno run -A npm:wrangler→bunx wrangler, per the Bun-over-Deno ruling. Both runtimes are installed locally; one-word change.The allowlist deliberately does not cover source or scripts
.gitleaks.tomlhandles the four remaining findings, all benign:telegram-bot/deno.lock— content-addressed integrity hashestelegram-bot/README.md,NEXT-STEPS.md— setup docs describing where a bot token goesavow-lib/ffi/zig/src/example.zig— carries the literal.token = "abc123def456..."next to the comment// Would be real tokenVerified in both directions:
deploy-repos.shThat second row is the one that matters. An allowlist that reopened the exact hole this repository just had would be worse than having no scanner.
⚠ The exposed token must still be revoked
Removing it from the file does not un-publish it. It has been readable by anyone for as long as this repo has been public, and public repos are continuously scraped.
Dashboard → My Profile → API Tokens → delete it. No replacement is needed once
wrangler loginhas been run once.Companion to #31 (which adds the scanner that found this). Merging both leaves the repo scanned and clean.
🤖 Generated with Claude Code