security(bridge): scrub committed sandbox apiKey + replaySecret (ENG-468)#435
Merged
islandbitcoin merged 1 commit intoJul 7, 2026
Merged
Conversation
…468) Aligns dev/config/base-config.yaml with main's placeholder convention — the bridge apiKey (a real sk-test-* sandbox key) and replaySecret were committed on this branch. lnflash/flash is PUBLIC, so these are exposed in git history. NOTE: this scrub does not remove them from history. The sandbox key must be ROTATED in the Bridge dashboard — coordinate with the live TEST BRIDGE_API_KEY (rotating breaks TEST until test.tfvars is updated). Refs ENG-468 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scrubs the Bridge
apiKey(sk-test-…sandbox key) andreplaySecretcommitted todev/config/base-config.yamlon this branch, aligning with main's placeholder convention (main already carriesapiKey: "").lnflash/flashis public. The key is in git history on a pushed branch, so it's already exposed and this commit does not remove it. The sandbox key must be rotated in the Bridge dashboard.Coordinate the rotation with live TEST: if
sk-test-3bd6463c9cd77c3d8858c60b9997d0c6is the same key currently intest.tfvarsasBRIDGE_API_KEY, rotating it breaks TEST's bridge flows until the tfvars value is updated andmake flash ENV=testre-applied.Separately noted (not fixed here)
base-config.yamlalso carries frappecredentials.apiKey/apiSecret(2701937b…) — these appear on main too, under the localhost frappe-docker block, so they look like the shared dev-container default rather than a deployed secret. Worth confirming they're not real for any deployed frappe; if they are, that's a separate rotation.🤖 Generated with Claude Code