CI supply chain: SCA, gitleaks, DinD TLS (#380) #904

Merged
PlasticDigits merged 11 commits from issue-380-ci-supply-chain-security into main 2026-06-14 02:53:36 +00:00
PlasticDigits commented 2026-06-13 10:14:31 +00:00 (Migrated from gitlab.com)

Summary

Adds a GitLab CI security stage for issue #380 (parent #376): mandatory gitleaks, cargo audit (smartcontracts + indexer with .cargo/audit.toml allowlists), npm audit --audit-level=high --omit=dev, and DinD TLS (DOCKER_HOST=tcp://docker:2376) for qa-wasm-artifacts. Documents accepted elliptic transitive risk (L-12) and local mirror targets in docs/supply-chain-security.md + skills/AGENTS_SUPPLY_CHAIN_SECURITY.md.

Also applies npm audit fix for high-severity runtime advisories and cargo update for indexer rustls-webpki / time.

Verify pass (2026-06-13): Fixed cargo-audit-* CI install guard — cached binary under ${CARGO_HOME}/bin is detected via test -x (not command -v, which missed cache path). MR pipeline 2599023634 green on security stage.

Acceptance checklist

Criterion Verification Result
Cargo + npm audit on relevant changes; documented allowlists .gitlab-ci.yml jobs + smartcontracts/.cargo/audit.toml, indexer/.cargo/audit.toml; make audit-smartcontracts, make audit-indexer, make audit-frontend PASS (local + CI pipeline 2599023634)
Gitleaks mandatory on default branch; fails on .gitleaks.toml patterns gitleaks job (no allow_failure); make verify-gitleaks (fixture fails, clean tree passes); CI gitleaks success PASS (local + CI)
DinD TLS; qa-wasm-artifacts green TLS vars in .gitlab-ci.yml L12–16, readiness loop L119–130; no DOCKER_TLS_CERTDIR: "" SKIP — job not in MR pipeline (rules: default-branch changes or web on main); verify after merge via manual web trigger
Elliptic accepted-risk / upgrade plan docs/supply-chain-security.md § Accepted runtime risk PASS

Verification checklist (issue #380)

Item Command / evidence Result
Security stage on .gitlab-ci.yml gitleaks, cargo-audit-*, npm-audit-frontend jobs; no allow_failure PASS
Default-branch unconditional security jobs .security-rules-default-branch rules PASS
make audit-smartcontracts cargo audit --deny warnings + allowlist PASS
make audit-indexer same PASS
make audit-frontend npm audit --audit-level=high --omit=dev (moderate elliptic only) PASS
make verify-gitleaks fixture trips bip39-like-phrase-frontend-src; tracked tree clean PASS
MR pipeline security stage pipeline 2599023634 all 4 jobs success PASS
qa-wasm-artifacts DinD TLS + wasm build glab ci run on feature branch → empty pipeline; needs post-merge web trigger on main SKIP (blocked: job rules)
Docs: docs/testing.md, docs/supply-chain-security.md, skills/AGENTS_SUPPLY_CHAIN_SECURITY.md cross-links present PASS
Pipeline budget (<5 min security stage) MR pipeline duration ~58s for security stage PASS

Follow-ups

  • After merge to main, run a manual web pipeline to confirm qa-wasm-artifacts with DinD TLS produces wasm artifacts.
  • Track CosmJS ≥ 0.34 / cosmes upgrade to clear moderate elliptic advisory (documented in docs/supply-chain-security.md).

Note

Medium Risk
Changes CI gates and Docker-in-Docker TLS for wasm builds (infrastructure/supply chain), not app auth logic; misconfigured gitleaks or audit allowlists could hide real issues.

Overview
Adds a GitLab CI security stage (#380): mandatory gitleaks (pinned image, git-tracked scan via scripts/ci/gitleaks-scan-tracked.sh), cargo audit for smartcontracts and indexer (with new .cargo/audit.toml allowlists), and npm audit (--audit-level=high --omit=dev) on the frontend. qa-wasm-artifacts switches from unencrypted DinD on 2375 to TLS on 2376 with a readiness loop.

Gitleaks drops path-based bypasses; the CI BIP39 fixture phrase is allowlisted by regex. New make targets mirror CI (audit-*, gitleaks-detect, verify-gitleaks) plus fixture verification scripts.

Docs now treat GitLab pipeline green as the default-branch gate for supply-chain jobs; docs/supply-chain-security.md and skills/AGENTS_SUPPLY_CHAIN_SECURITY.md document allowlists, DinD TLS, and accepted moderate elliptic risk (L-12). Lockfiles pick up frontend dependency bumps (e.g. @goblinhunt/cosmes, react-router) and indexer transitive updates.

Reviewed by Cursor Bugbot for commit 92ade2e570. Bugbot is set up for automated code reviews on this repo. Configure here.

## Summary Adds a GitLab CI `security` stage for issue #380 (parent #376): mandatory gitleaks, `cargo audit` (smartcontracts + indexer with `.cargo/audit.toml` allowlists), `npm audit --audit-level=high --omit=dev`, and **DinD TLS** (`DOCKER_HOST=tcp://docker:2376`) for `qa-wasm-artifacts`. Documents accepted `elliptic` transitive risk (L-12) and local mirror targets in `docs/supply-chain-security.md` + `skills/AGENTS_SUPPLY_CHAIN_SECURITY.md`. Also applies `npm audit fix` for high-severity runtime advisories and `cargo update` for indexer `rustls-webpki` / `time`. **Verify pass (2026-06-13):** Fixed `cargo-audit-*` CI install guard — cached binary under `${CARGO_HOME}/bin` is detected via `test -x` (not `command -v`, which missed cache path). MR pipeline [2599023634](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/pipelines/2599023634) green on security stage. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Cargo + npm audit on relevant changes; documented allowlists | `.gitlab-ci.yml` jobs + `smartcontracts/.cargo/audit.toml`, `indexer/.cargo/audit.toml`; `make audit-smartcontracts`, `make audit-indexer`, `make audit-frontend` | **PASS** (local + CI pipeline 2599023634) | | Gitleaks mandatory on default branch; fails on `.gitleaks.toml` patterns | `gitleaks` job (no `allow_failure`); `make verify-gitleaks` (fixture fails, clean tree passes); CI `gitleaks` success | **PASS** (local + CI) | | DinD TLS; `qa-wasm-artifacts` green | TLS vars in `.gitlab-ci.yml` L12–16, readiness loop L119–130; no `DOCKER_TLS_CERTDIR: ""` | **SKIP** — job not in MR pipeline (rules: default-branch changes or `web` on main); verify after merge via manual web trigger | | Elliptic accepted-risk / upgrade plan | `docs/supply-chain-security.md` § Accepted runtime risk | **PASS** | ## Verification checklist (issue #380) | Item | Command / evidence | Result | |------|-------------------|--------| | Security stage on `.gitlab-ci.yml` | `gitleaks`, `cargo-audit-*`, `npm-audit-frontend` jobs; no `allow_failure` | **PASS** | | Default-branch unconditional security jobs | `.security-rules-default-branch` rules | **PASS** | | `make audit-smartcontracts` | `cargo audit --deny warnings` + allowlist | **PASS** | | `make audit-indexer` | same | **PASS** | | `make audit-frontend` | `npm audit --audit-level=high --omit=dev` (moderate elliptic only) | **PASS** | | `make verify-gitleaks` | fixture trips `bip39-like-phrase-frontend-src`; tracked tree clean | **PASS** | | MR pipeline security stage | [pipeline 2599023634](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/pipelines/2599023634) all 4 jobs success | **PASS** | | `qa-wasm-artifacts` DinD TLS + wasm build | `glab ci run` on feature branch → empty pipeline; needs post-merge `web` trigger on `main` | **SKIP** (blocked: job rules) | | Docs: `docs/testing.md`, `docs/supply-chain-security.md`, `skills/AGENTS_SUPPLY_CHAIN_SECURITY.md` | cross-links present | **PASS** | | Pipeline budget (&lt;5 min security stage) | MR pipeline duration ~58s for security stage | **PASS** | ## Follow-ups - After merge to `main`, run a manual **web** pipeline to confirm `qa-wasm-artifacts` with DinD TLS produces wasm artifacts. - Track CosmJS ≥ 0.34 / cosmes upgrade to clear moderate `elliptic` advisory (documented in `docs/supply-chain-security.md`). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Changes CI gates and Docker-in-Docker TLS for wasm builds (infrastructure/supply chain), not app auth logic; misconfigured gitleaks or audit allowlists could hide real issues. > > **Overview** > Adds a **GitLab CI `security` stage** (#380): mandatory **gitleaks** (pinned image, git-tracked scan via `scripts/ci/gitleaks-scan-tracked.sh`), **cargo audit** for smartcontracts and indexer (with new `.cargo/audit.toml` allowlists), and **npm audit** (`--audit-level=high --omit=dev`) on the frontend. **`qa-wasm-artifacts`** switches from unencrypted DinD on **2375** to **TLS on 2376** with a readiness loop. > > **Gitleaks** drops path-based bypasses; the CI BIP39 fixture phrase is allowlisted by regex. New **`make`** targets mirror CI (`audit-*`, `gitleaks-detect`, `verify-gitleaks`) plus fixture verification scripts. > > Docs now treat **GitLab pipeline green** as the default-branch gate for supply-chain jobs; **`docs/supply-chain-security.md`** and **`skills/AGENTS_SUPPLY_CHAIN_SECURITY.md`** document allowlists, DinD TLS, and accepted moderate **`elliptic`** risk (L-12). Lockfiles pick up frontend dependency bumps (e.g. `@goblinhunt/cosmes`, `react-router`) and indexer transitive updates. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 92ade2e5700727c4721734e3a2b5f3933941eb54. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
ghost1 commented 2026-06-13 10:14:38 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-13 10:14:47 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-13 10:16:03 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit b2b9dd06d5. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b2b9dd06d5f83c71a1706af35564c63caf6919bd. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details> </details> </details>
ghost1 commented 2026-06-13 10:16:04 +00:00 (Migrated from gitlab.com)

Duplicate frontend directory change fails

Medium Severity

In npm-audit-frontend, before_script already cds into frontend-dapp for npm ci. GitLab runs before_script and script in the same shell, so the script’s second cd frontend-dapp looks for a nested folder that is not there and the job exits before npm audit runs.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit b2b9dd06d5. Configure here.

### Duplicate frontend directory change fails **Medium Severity** <!-- DESCRIPTION START --> In `npm-audit-frontend`, `before_script` already `cd`s into `frontend-dapp` for `npm ci`. GitLab runs `before_script` and `script` in the same shell, so the script’s second `cd frontend-dapp` looks for a nested folder that is not there and the job exits before `npm audit` runs. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 1e4f9c20-579a-4e5e-a073-d9bc0d621ac5 --> <!-- LOCATIONS START .gitlab-ci.yml#L90-L94 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjYyYjA4ZDA3LTY1YzEtNDhlOC1iN2FiLTJmNzQ3YjFkNDhjOSIsImVuY3J5cHRpb25LZXkiOiJhVko1Q1k1YlFPZFlwUk95aWs0eFBWdnF5a1lqX1ZpT1ZfYVNFQlI0dDlBIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjYyYjA4ZDA3LTY1YzEtNDhlOC1iN2FiLTJmNzQ3YjFkNDhjOSIsImVuY3J5cHRpb25LZXkiOiJhVko1Q1k1YlFPZFlwUk95aWs0eFBWdnF5a1lqX1ZpT1ZfYVNFQlI0dDlBIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjoxODYsImNvbW1pdFNoYSI6ImIyYjlkZDA2ZDVmODNjNzFhMTcwNmFmMzU1NjRjNjNjYWY2OTE5YmQiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b2b9dd06d5f83c71a1706af35564c63caf6919bd. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-13 10:17:28 +00:00 (Migrated from gitlab.com)

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850276000&start_sha=b2b9dd06d5f83c71a1706af35564c63caf6919bd#587d266bb27a4dc3022bbed44dfa19849df3044c_94_94)
ghost1 commented 2026-06-13 10:17:28 +00:00 (Migrated from gitlab.com)

added 1 commit

  • ae184f61 - fix(ci): run npm audit from frontend-dapp cwd after npm ci

Compare with previous version

added 1 commit <ul><li>ae184f61 - fix(ci): run npm audit from frontend-dapp cwd after npm ci</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850276000&start_sha=b2b9dd06d5f83c71a1706af35564c63caf6919bd)
ghost1 commented 2026-06-13 10:17:39 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
ghost1 commented 2026-06-13 10:17:41 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-13 10:18:23 +00:00 (Migrated from gitlab.com)

Severity: High — gitleaks control bypass via over-broad fixture path allowlist

Issue: The global [allowlist].paths entry scripts/ci/gitleaks-fixture/ excludes the entire directory tree from all gitleaks rules (defaults + bip39-like-phrase-frontend-src). Any contributor can add arbitrary secrets under this prefix and pass mandatory CI gitleaks (M-13).

Impact: Wallet mnemonics, API tokens, or other credentials can be committed without tripping the #118 BIP39 rule or generic detectors, defeating the stated mandatory gate.

Verified: With image ghcr.io/gitleaks/gitleaks:v8.24.2 and this config:

  • ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890 in scripts/ci/gitleaks-fixture/gh-token.txt → no leaks
  • Same token in frontend-dapp/src/gh-token.txt → leak detected (github-pat)
  • BIP39-like quoted phrase in scripts/ci/gitleaks-fixture/frontend-dapp/src/leak-test.ts → no leaks
  • Same phrase in frontend-dapp/src/leak-test.ts → leak detected

Fix: Do not path-allowlist the whole fixture tree in .gitleaks.toml. verify-gitleaks.sh already scans the fixture with a separate minimal config (scripts/ci/gitleaks-fixture.toml); keep the main config strict and exclude only the single known test file (or relocate fixture outside the repo root scan).

**Severity: High** — gitleaks control bypass via over-broad fixture path allowlist **Issue:** The global `[allowlist].paths` entry `scripts/ci/gitleaks-fixture/` excludes the entire directory tree from **all** gitleaks rules (defaults + `bip39-like-phrase-frontend-src`). Any contributor can add arbitrary secrets under this prefix and pass mandatory CI gitleaks (M-13). **Impact:** Wallet mnemonics, API tokens, or other credentials can be committed without tripping the #118 BIP39 rule or generic detectors, defeating the stated mandatory gate. **Verified:** With image `ghcr.io/gitleaks/gitleaks:v8.24.2` and this config: - `ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890` in `scripts/ci/gitleaks-fixture/gh-token.txt` → **no leaks** - Same token in `frontend-dapp/src/gh-token.txt` → **leak detected** (`github-pat`) - BIP39-like quoted phrase in `scripts/ci/gitleaks-fixture/frontend-dapp/src/leak-test.ts` → **no leaks** - Same phrase in `frontend-dapp/src/leak-test.ts` → **leak detected** **Fix:** Do not path-allowlist the whole fixture tree in `.gitleaks.toml`. `verify-gitleaks.sh` already scans the fixture with a separate minimal config (`scripts/ci/gitleaks-fixture.toml`); keep the main config strict and exclude only the single known test file (or relocate fixture outside the repo root scan).
PlasticDigits commented 2026-06-13 10:18:27 +00:00 (Migrated from gitlab.com)

Severity: Medium — gitleaks not enforced on merge-request pipelines

Issue: gitleaks extends .security-rules-default-branch, which only runs on $CI_DEFAULT_BRANCH and schedule. Unlike cargo-audit-* and npm-audit-frontend, there is no merge_request_event rule.

Impact: An MR that changes only application source (e.g. frontend-dapp/src/**) without touching lockfiles, smartcontracts/**, or indexer/** runs zero security stage jobs. A quoted dev mnemonic or other secret can merge with a green MR pipeline; detection waits until a default-branch pipeline (or never, if removed before that run and --no-git leaves history unscaned).

Attack path: Open MR adding FAKE_DEV_SEED = "<12-word mnemonic>" under frontend-dapp/src/ → MR pipeline has no gitleaks/audit jobs → merge → secret in public history.

Fix: Add MR rules for gitleaks (at minimum when frontend-dapp/**, .gitleaks.toml, or .gitlab-ci.yml change; preferably on every MR).

**Severity: Medium** — gitleaks not enforced on merge-request pipelines **Issue:** `gitleaks` extends `.security-rules-default-branch`, which only runs on `$CI_DEFAULT_BRANCH` and `schedule`. Unlike `cargo-audit-*` and `npm-audit-frontend`, there is no `merge_request_event` rule. **Impact:** An MR that changes only application source (e.g. `frontend-dapp/src/**`) without touching lockfiles, `smartcontracts/**`, or `indexer/**` runs **zero** `security` stage jobs. A quoted dev mnemonic or other secret can merge with a green MR pipeline; detection waits until a default-branch pipeline (or never, if removed before that run and `--no-git` leaves history unscaned). **Attack path:** Open MR adding `FAKE_DEV_SEED = "<12-word mnemonic>"` under `frontend-dapp/src/` → MR pipeline has no gitleaks/audit jobs → merge → secret in public history. **Fix:** Add MR rules for `gitleaks` (at minimum when `frontend-dapp/**`, `.gitleaks.toml`, or `.gitlab-ci.yml` change; preferably on every MR).
PlasticDigits commented 2026-06-13 10:18:34 +00:00 (Migrated from gitlab.com)

Security review — MR !904

Commit reviewed: b2b9dd06d5f83c71a1706af35564c63caf6919bd
Scope: .gitlab-ci.yml security stage (gitleaks, cargo-audit, npm audit), DinD TLS for qa-wasm-artifacts, .gitleaks.toml allowlists, CI helper scripts, lockfile bumps, supply-chain docs.

Outcome: FINDINGS: 2 (1 high, 1 medium)

Findings

Sev Topic Location
High scripts/ci/gitleaks-fixture/ path allowlist bypasses mandatory gitleaks (incl. BIP39 rule) .gitleaks.toml — inline thread
Medium gitleaks job not scheduled on MR pipelines; source-only MRs can skip entire security stage .gitlab-ci.yml — inline thread

Notes

  • DinD TLS migration (2375 → 2376) is a hardening change; no issue found with the readiness loop.
  • cargo-audit / npm audit allowlists and lockfile bumps are documented accepted-risk / patch upgrades; no new exploitable runtime paths identified in application code.
  • Prior security-review threads: none on this MR.

Please resolve or acknowledge inline threads before merge.

## Security review — MR !904 **Commit reviewed:** `b2b9dd06d5f83c71a1706af35564c63caf6919bd` **Scope:** `.gitlab-ci.yml` security stage (gitleaks, cargo-audit, npm audit), DinD TLS for `qa-wasm-artifacts`, `.gitleaks.toml` allowlists, CI helper scripts, lockfile bumps, supply-chain docs. **Outcome:** `FINDINGS: 2` (1 high, 1 medium) ### Findings | Sev | Topic | Location | |-----|-------|----------| | **High** | `scripts/ci/gitleaks-fixture/` path allowlist bypasses mandatory gitleaks (incl. BIP39 rule) | `.gitleaks.toml` — inline thread | | **Medium** | `gitleaks` job not scheduled on MR pipelines; source-only MRs can skip entire `security` stage | `.gitlab-ci.yml` — inline thread | ### Notes - DinD TLS migration (`2375` → `2376`) is a hardening change; no issue found with the readiness loop. - `cargo-audit` / `npm audit` allowlists and lockfile bumps are documented accepted-risk / patch upgrades; no new exploitable runtime paths identified in application code. - Prior security-review threads: none on this MR. Please resolve or acknowledge inline threads before merge.
PlasticDigits commented 2026-06-13 10:38:59 +00:00 (Migrated from gitlab.com)

changed this line in version 3 of the diff

changed this line in [version 3 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850282029&start_sha=ae184f6110b993f3d79110aff5ade760d372e7c5#54a6edd84cf35001d6e7c047af8b13b63ca40809_24_23)
PlasticDigits commented 2026-06-13 10:38:59 +00:00 (Migrated from gitlab.com)

added 1 commit

  • e53ae252 - fix(security): tighten gitleaks allowlist and run on MR pipelines

Compare with previous version

added 1 commit <ul><li>e53ae252 - fix(security): tighten gitleaks allowlist and run on MR pipelines</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850282029&start_sha=ae184f6110b993f3d79110aff5ade760d372e7c5)
PlasticDigits commented 2026-06-13 10:39:04 +00:00 (Migrated from gitlab.com)

Security fixes (e53ae252)

Finding Severity Fix
scripts/ci/gitleaks-fixture/ path allowlist bypasses all gitleaks rules High Replaced directory-wide allowlist with a single-file entry for scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts in .gitleaks.toml. Verified: ghp_… and BIP39-like phrases in other paths under the fixture tree are now detected.
gitleaks job not scheduled on MR pipelines Medium Added merge_request_event rule to gitleaks in .gitlab-ci.yml so every MR runs the mandatory scan.
Duplicate cd frontend-dapp in npm-audit-frontend Medium (Bugbot) Already fixed in ae184f61 — script runs npm audit from the before_script cwd.

Verification: make verify-gitleaks passes locally; manual abuse checks confirm fixture-dir bypass is closed.

## Security fixes (`e53ae252`) | Finding | Severity | Fix | |---------|----------|-----| | `scripts/ci/gitleaks-fixture/` path allowlist bypasses all gitleaks rules | **High** | Replaced directory-wide allowlist with a single-file entry for `scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts` in `.gitleaks.toml`. Verified: `ghp_…` and BIP39-like phrases in other paths under the fixture tree are now detected. | | `gitleaks` job not scheduled on MR pipelines | **Medium** | Added `merge_request_event` rule to `gitleaks` in `.gitlab-ci.yml` so every MR runs the mandatory scan. | | Duplicate `cd frontend-dapp` in `npm-audit-frontend` | **Medium** (Bugbot) | Already fixed in `ae184f61` — `script` runs `npm audit` from the `before_script` cwd. | **Verification:** `make verify-gitleaks` passes locally; manual abuse checks confirm fixture-dir bypass is closed.
ghost1 commented 2026-06-13 10:39:17 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-13 10:41:17 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit e53ae25285. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e53ae25285d87d2e263b7069d493f34fb43028e7. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details> </details>
ghost1 commented 2026-06-13 10:41:18 +00:00 (Migrated from gitlab.com)

Gitleaks fixture path suffix bypass

Medium Severity

The global allowlist entry for the CI fixture matches any scanned path whose string ends with scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts, without requiring that prefix at the repository root. A file under frontend-dapp/src/ (where the BIP39 rule applies) can use that suffix and have quoted mnemonics skipped by mandatory gitleaks.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit e53ae25285. Configure here.

### Gitleaks fixture path suffix bypass **Medium Severity** <!-- DESCRIPTION START --> The global allowlist entry for the CI fixture matches any scanned path whose string ends with `scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts`, without requiring that prefix at the repository root. A file under `frontend-dapp/src/` (where the BIP39 rule applies) can use that suffix and have quoted mnemonics skipped by mandatory gitleaks. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 8424ac05-eb29-4728-ae43-554522bcb337 --> <!-- LOCATIONS START .gitleaks.toml#L24-L25 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmRkMTNlM2MzLTNmYzgtNDYxNC1iMDkxLTRkNjFlYzkxZjFhNyIsImVuY3J5cHRpb25LZXkiOiJUYV9makNJeW1rODNwNW9MOVpSVDZpMXlaYW9kemNGbFlrX054alJsSGRZIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmRkMTNlM2MzLTNmYzgtNDYxNC1iMDkxLTRkNjFlYzkxZjFhNyIsImVuY3J5cHRpb25LZXkiOiJUYV9makNJeW1rODNwNW9MOVpSVDZpMXlaYW9kemNGbFlrX054alJsSGRZIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjoxODYsImNvbW1pdFNoYSI6ImU1M2FlMjUyODVkODdkMmUyNjNiNzA2OWQ0OTNmMzRmYjQzMDI4ZTciLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e53ae25285d87d2e263b7069d493f34fb43028e7. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-13 10:42:09 +00:00 (Migrated from gitlab.com)

Severity: Medium — gitleaks bypass via global build-output path allowlist

Issue: The global [allowlist].paths regex (?:^|/)(?:target|node_modules|dist|coverage)(?:/|$) excludes all files under those directories from every gitleaks rule (defaults + bip39-like-phrase-frontend-src).

Impact: A contributor can git add -f a secret under e.g. frontend-dapp/dist/ or frontend-dapp/node_modules/ and pass mandatory CI gitleaks (M-13). The prior fixture-directory bypass was tightened in e53ae252; this path class has the same effect for gitignored build dirs.

Verified (image ghcr.io/gitleaks/gitleaks:v8.24.2, config at e53ae252):

  • ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890 in frontend-dapp/dist/gh-token.txt → no leaks
  • Same token in frontend-dapp/node_modules/.cache/token → no leaks
  • Same token in frontend-dapp/src/gh-token.txt → leak detected (github-pat)

Fix: Do not globally allowlist entire build trees in .gitleaks.toml. Prefer rule-scoped allowlists, a .gitleaksignore for local-only scans, or restrict CI --source to tracked paths excluding build dirs (CI gitleaks job does not need node_modules/dist present).

**Severity: Medium** — gitleaks bypass via global build-output path allowlist **Issue:** The global `[allowlist].paths` regex `(?:^|/)(?:target|node_modules|dist|coverage)(?:/|$)` excludes **all** files under those directories from every gitleaks rule (defaults + `bip39-like-phrase-frontend-src`). **Impact:** A contributor can `git add -f` a secret under e.g. `frontend-dapp/dist/` or `frontend-dapp/node_modules/` and pass mandatory CI gitleaks (M-13). The prior fixture-directory bypass was tightened in `e53ae252`; this path class has the same effect for gitignored build dirs. **Verified** (image `ghcr.io/gitleaks/gitleaks:v8.24.2`, config at `e53ae252`): - `ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890` in `frontend-dapp/dist/gh-token.txt` → **no leaks** - Same token in `frontend-dapp/node_modules/.cache/token` → **no leaks** - Same token in `frontend-dapp/src/gh-token.txt` → **leak detected** (`github-pat`) **Fix:** Do not globally allowlist entire build trees in `.gitleaks.toml`. Prefer rule-scoped allowlists, a `.gitleaksignore` for local-only scans, or restrict CI `--source` to tracked paths excluding build dirs (CI gitleaks job does not need `node_modules`/`dist` present).
PlasticDigits commented 2026-06-13 10:42:16 +00:00 (Migrated from gitlab.com)

Security review — MR !904 (re-review)

Commit reviewed: e53ae25285d87d2e263b7069d493f34fb43028e7
Scope: .gitlab-ci.yml security stage (gitleaks, cargo-audit, npm audit), DinD TLS for qa-wasm-artifacts, .gitleaks.toml allowlists, CI helper scripts, lockfile bumps, supply-chain docs.

Outcome: FINDINGS: 1 medium

Prior findings (resolved in e53ae252)

Sev Topic Status
High scripts/ci/gitleaks-fixture/ directory path allowlist bypassed all rules Fixed — narrowed to single file bip39-violation.ts; verified ghp_… and extra BIP39 phrases elsewhere under fixture tree are now detected
Medium gitleaks job missing merge_request_event rule Fixed — MR pipelines now run mandatory gitleaks

New finding

Sev Topic Location
Medium Global dist/node_modules/target/coverage path allowlist bypasses mandatory gitleaks for force-added secrets .gitleaks.toml — inline thread

Notes

  • DinD TLS migration (2375 → 2376) and readiness loop are hardening; no issue found.
  • cargo-audit / npm audit allowlists and lockfile bumps (react-router, rustls-webpki, cosmes patch) are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code.
  • npm-audit-frontend cwd fix (ae184f61) verified — script runs npm audit from before_script cwd.

See inline thread for the open finding.

## Security review — MR !904 (re-review) **Commit reviewed:** `e53ae25285d87d2e263b7069d493f34fb43028e7` **Scope:** `.gitlab-ci.yml` security stage (gitleaks, cargo-audit, npm audit), DinD TLS for `qa-wasm-artifacts`, `.gitleaks.toml` allowlists, CI helper scripts, lockfile bumps, supply-chain docs. **Outcome:** `FINDINGS: 1` medium ### Prior findings (resolved in `e53ae252`) | Sev | Topic | Status | |-----|-------|--------| | High | `scripts/ci/gitleaks-fixture/` directory path allowlist bypassed all rules | **Fixed** — narrowed to single file `bip39-violation.ts`; verified `ghp_…` and extra BIP39 phrases elsewhere under fixture tree are now detected | | Medium | `gitleaks` job missing `merge_request_event` rule | **Fixed** — MR pipelines now run mandatory gitleaks | ### New finding | Sev | Topic | Location | |-----|-------|----------| | **Medium** | Global `dist`/`node_modules`/`target`/`coverage` path allowlist bypasses mandatory gitleaks for force-added secrets | `.gitleaks.toml` — inline thread | ### Notes - DinD TLS migration (`2375` → `2376`) and readiness loop are hardening; no issue found. - `cargo-audit` / `npm audit` allowlists and lockfile bumps (`react-router`, `rustls-webpki`, cosmes patch) are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code. - `npm-audit-frontend` cwd fix (`ae184f61`) verified — `script` runs `npm audit` from `before_script` cwd. See inline thread for the open finding.
ghost1 commented 2026-06-13 10:43:24 +00:00 (Migrated from gitlab.com)

changed this line in version 4 of the diff

changed this line in [version 4 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850283395&start_sha=e53ae25285d87d2e263b7069d493f34fb43028e7#54a6edd84cf35001d6e7c047af8b13b63ca40809_25_25)
ghost1 commented 2026-06-13 10:43:24 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 079b9885 - fix: anchor gitleaks fixture allowlist to repo root (#380)

Compare with previous version

added 1 commit <ul><li>079b9885 - fix: anchor gitleaks fixture allowlist to repo root (#380)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850283395&start_sha=e53ae25285d87d2e263b7069d493f34fb43028e7)
ghost1 commented 2026-06-13 10:43:38 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-13 13:31:34 +00:00 (Migrated from gitlab.com)

changed this line in version 5 of the diff

changed this line in [version 5 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850334130&start_sha=079b98858def4fbb05a03a2228c47f4cdf56252c#54a6edd84cf35001d6e7c047af8b13b63ca40809_27_22)
PlasticDigits commented 2026-06-13 13:31:34 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 67ed1966 - fix(security): scan git-tracked files only for gitleaks (#380)

Compare with previous version

added 1 commit <ul><li>67ed1966 - fix(security): scan git-tracked files only for gitleaks (#380)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850334130&start_sha=079b98858def4fbb05a03a2228c47f4cdf56252c)
PlasticDigits commented 2026-06-13 13:31:36 +00:00 (Migrated from gitlab.com)

Security fixes (67ed1966)

Finding Severity Fix
Global dist/node_modules/target/coverage path allowlist bypasses mandatory gitleaks Medium Removed all path allowlists from .gitleaks.toml. CI/local scans now stage git-tracked files via scripts/ci/gitleaks-scan-tracked.sh (excludes fixture tree + untracked build artifacts) so force-added secrets under build dirs are detected.
Gitleaks fixture path suffix bypass (Bugbot) Medium No longer applicable — fixture tree is excluded from the main scan; no path allowlist entry remains. Suffix paths under frontend-dapp/src/ are scanned and fail as expected.
scripts/ci/gitleaks-fixture/ directory allowlist bypass High Already fixed in e53ae252; superseded by tracked-only scan (no fixture allowlist needed).
gitleaks job not on MR pipelines Medium Already fixed in e53ae252.
Duplicate cd frontend-dapp in npm-audit-frontend Medium (Bugbot) Already fixed in ae184f61.

Verification: make verify-gitleaks passes; manual abuse checks confirm ghp_… in frontend-dapp/dist/ and BIP39-like phrases under suffix paths are now detected.

## Security fixes (`67ed1966`) | Finding | Severity | Fix | |---------|----------|-----| | Global `dist`/`node_modules`/`target`/`coverage` path allowlist bypasses mandatory gitleaks | **Medium** | Removed all path allowlists from `.gitleaks.toml`. CI/local scans now stage **git-tracked** files via `scripts/ci/gitleaks-scan-tracked.sh` (excludes fixture tree + untracked build artifacts) so force-added secrets under build dirs are detected. | | Gitleaks fixture path suffix bypass (Bugbot) | **Medium** | No longer applicable — fixture tree is excluded from the main scan; no path allowlist entry remains. Suffix paths under `frontend-dapp/src/` are scanned and fail as expected. | | `scripts/ci/gitleaks-fixture/` directory allowlist bypass | **High** | Already fixed in `e53ae252`; superseded by tracked-only scan (no fixture allowlist needed). | | `gitleaks` job not on MR pipelines | **Medium** | Already fixed in `e53ae252`. | | Duplicate `cd frontend-dapp` in `npm-audit-frontend` | **Medium** (Bugbot) | Already fixed in `ae184f61`. | **Verification:** `make verify-gitleaks` passes; manual abuse checks confirm `ghp_…` in `frontend-dapp/dist/` and BIP39-like phrases under suffix paths are now detected.
ghost1 commented 2026-06-13 13:31:48 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-13 13:32:47 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit 67ed19662e. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 67ed19662e16b60b37d21e85a3cccbae82a20c14. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details>
ghost1 commented 2026-06-13 13:32:48 +00:00 (Migrated from gitlab.com)

Fixture tree skips mandatory gitleaks

High Severity

Mandatory CI gitleaks omits every git-tracked path under scripts/ci/gitleaks-fixture/, not only the intentional BIP39 fixture. After removing .gitleaks.toml path allowlists, that prefix becomes a blind spot: generic and custom rules never run on other tracked files there, so credentials can land on the default branch when hooks are skipped.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 67ed19662e. Configure here.

### Fixture tree skips mandatory gitleaks **High Severity** <!-- DESCRIPTION START --> Mandatory CI gitleaks omits every git-tracked path under `scripts/ci/gitleaks-fixture/`, not only the intentional BIP39 fixture. After removing `.gitleaks.toml` path allowlists, that prefix becomes a blind spot: generic and custom rules never run on other tracked files there, so credentials can land on the default branch when hooks are skipped. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 1de9efad-1dc0-4796-9ad6-2873ca18bf37 --> <!-- LOCATIONS START scripts/ci/gitleaks-scan-tracked.sh#L13-L15 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjRjYmZhZmQwLTc3NTgtNDU5OC05NGU1LTQ5MzkyYzM5YWI5MCIsImVuY3J5cHRpb25LZXkiOiJteHhDVkhfemJuRWZTaExPRVpLVmtaTVdEZ0VVRjNTZk5fRnBWdTNZT0ZnIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjRjYmZhZmQwLTc3NTgtNDU5OC05NGU1LTQ5MzkyYzM5YWI5MCIsImVuY3J5cHRpb25LZXkiOiJteHhDVkhfemJuRWZTaExPRVpLVmtaTVdEZ0VVRjNTZk5fRnBWdTNZT0ZnIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjoxODYsImNvbW1pdFNoYSI6IjY3ZWQxOTY2MmUxNmI2MGIzN2QyMWU4NWEzY2NjYmFlODJhMjBjMTQiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 67ed19662e16b60b37d21e85a3cccbae82a20c14. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-13 13:34:13 +00:00 (Migrated from gitlab.com)

Severity: High — mandatory gitleaks bypass via fixture-tree exclusion

Issue: stage_tracked_tree skips every git-tracked path under scripts/ci/gitleaks-fixture/. After removing .gitleaks.toml path allowlists (67ed1966), this prefix is the only blind spot in the mandatory CI scan.

Impact: Credentials committed under that directory pass gitleaks on default-branch and MR pipelines (M-13). Pre-commit is best-effort (gitleaks optional locally; hooks can be skipped).

Verified (image ghcr.io/gitleaks/gitleaks:v8.24.2, HEAD 67ed1966):

  • ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890 in tracked scripts/ci/gitleaks-fixture/gh-token-test.txt → no leaks (CI scan exit 0)
  • Same token in tracked frontend-dapp/src/gh-token-test.txt → leak detected (github-pat, exit 1)
  • BIP39-like quoted phrase in tracked scripts/ci/gitleaks-fixture/frontend-dapp/src/extra-leak.ts → no leaks
  • Same phrase in frontend-dapp/src/ → leak detected (bip39-like-phrase-frontend-src)

Attack path: Add secret file under scripts/ci/gitleaks-fixture/ (path is documented in supply-chain docs) → MR/default-branch gitleaks job green → secret in public git history.

Fix: Do not exclude the whole fixture tree from the main scan. Options: (a) scan fixture with main config but allowlist only bip39-violation.ts via anchored full path; (b) keep fixture outside repo root for verify-gitleaks only; (c) scan fixture separately in CI with gitleaks-fixture.toml and fail on any additional leaks beyond the known violation file.

**Severity: High** — mandatory gitleaks bypass via fixture-tree exclusion **Issue:** `stage_tracked_tree` skips every git-tracked path under `scripts/ci/gitleaks-fixture/`. After removing `.gitleaks.toml` path allowlists (`67ed1966`), this prefix is the only blind spot in the mandatory CI scan. **Impact:** Credentials committed under that directory pass `gitleaks` on default-branch and MR pipelines (M-13). Pre-commit is best-effort (`gitleaks` optional locally; hooks can be skipped). **Verified** (image `ghcr.io/gitleaks/gitleaks:v8.24.2`, HEAD `67ed1966`): - `ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890` in tracked `scripts/ci/gitleaks-fixture/gh-token-test.txt` → **no leaks** (CI scan exit 0) - Same token in tracked `frontend-dapp/src/gh-token-test.txt` → **leak detected** (`github-pat`, exit 1) - BIP39-like quoted phrase in tracked `scripts/ci/gitleaks-fixture/frontend-dapp/src/extra-leak.ts` → **no leaks** - Same phrase in `frontend-dapp/src/` → **leak detected** (`bip39-like-phrase-frontend-src`) **Attack path:** Add secret file under `scripts/ci/gitleaks-fixture/` (path is documented in supply-chain docs) → MR/default-branch `gitleaks` job green → secret in public git history. **Fix:** Do not exclude the whole fixture tree from the main scan. Options: (a) scan fixture with main config but allowlist only `bip39-violation.ts` via anchored full path; (b) keep fixture outside repo root for `verify-gitleaks` only; (c) scan fixture separately in CI with `gitleaks-fixture.toml` and fail on any *additional* leaks beyond the known violation file.
PlasticDigits commented 2026-06-13 13:34:20 +00:00 (Migrated from gitlab.com)

Security review — MR !904

Commit reviewed: 67ed19662e16b60b37d21e85a3cccbae82a20c14
Scope: .gitlab-ci.yml security stage (gitleaks, cargo-audit, npm audit), DinD TLS for qa-wasm-artifacts, scripts/ci/gitleaks-scan-tracked.sh, .gitleaks.toml, audit allowlists, lockfile bumps, supply-chain docs.

Outcome: FINDINGS: 1 (1 high)

Findings

Sev Topic Location
High Fixture-tree exclusion in gitleaks-scan-tracked.sh bypasses mandatory CI gitleaks for any secret under scripts/ci/gitleaks-fixture/ scripts/ci/gitleaks-scan-tracked.sh L15 — inline thread

Prior findings (resolved; not re-reported)

Sev Topic Status
High .gitleaks.toml directory-wide fixture path allowlist Fixed in e53ae252, superseded by tracked-only scan
Medium gitleaks job missing merge_request_event Fixed in e53ae252
Medium Global dist/node_modules path allowlist bypass Fixed in 67ed1966 (tracked-only scan)
Medium Fixture path suffix allowlist bypass Fixed in 67ed1966 (no path allowlists remain)
Medium Duplicate cd frontend-dapp in npm-audit-frontend Fixed in ae184f61

Notes

  • DinD TLS migration (2375 → 2376) and readiness loop are hardening; no issue found.
  • cargo-audit / npm audit allowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code.
  • make verify-gitleaks passes on the clean tree; the open finding is an intentional-exclusion side effect, not a false positive in the fixture self-test.

See inline thread for the open finding.

## Security review — MR !904 **Commit reviewed:** `67ed19662e16b60b37d21e85a3cccbae82a20c14` **Scope:** `.gitlab-ci.yml` security stage (gitleaks, cargo-audit, npm audit), DinD TLS for `qa-wasm-artifacts`, `scripts/ci/gitleaks-scan-tracked.sh`, `.gitleaks.toml`, audit allowlists, lockfile bumps, supply-chain docs. **Outcome:** `FINDINGS: 1` (1 high) ### Findings | Sev | Topic | Location | |-----|-------|----------| | **High** | Fixture-tree exclusion in `gitleaks-scan-tracked.sh` bypasses mandatory CI gitleaks for any secret under `scripts/ci/gitleaks-fixture/` | `scripts/ci/gitleaks-scan-tracked.sh` L15 — inline thread | ### Prior findings (resolved; not re-reported) | Sev | Topic | Status | |-----|-------|--------| | High | `.gitleaks.toml` directory-wide fixture path allowlist | **Fixed** in `e53ae252`, superseded by tracked-only scan | | Medium | `gitleaks` job missing `merge_request_event` | **Fixed** in `e53ae252` | | Medium | Global `dist`/`node_modules` path allowlist bypass | **Fixed** in `67ed1966` (tracked-only scan) | | Medium | Fixture path suffix allowlist bypass | **Fixed** in `67ed1966` (no path allowlists remain) | | Medium | Duplicate `cd frontend-dapp` in `npm-audit-frontend` | **Fixed** in `ae184f61` | ### Notes - DinD TLS migration (`2375` → `2376`) and readiness loop are hardening; no issue found. - `cargo-audit` / `npm audit` allowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code. - `make verify-gitleaks` passes on the clean tree; the open finding is an intentional-exclusion side effect, not a false positive in the fixture self-test. See inline thread for the open finding.
ghost1 commented 2026-06-13 13:34:45 +00:00 (Migrated from gitlab.com)

changed this line in version 6 of the diff

changed this line in [version 6 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850334932&start_sha=67ed19662e16b60b37d21e85a3cccbae82a20c14#fe1ad0d573be637bf03fc59bb4402997bdd31b40_15_15)
ghost1 commented 2026-06-13 13:34:45 +00:00 (Migrated from gitlab.com)

changed this line in version 6 of the diff

changed this line in [version 6 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850334932&start_sha=67ed19662e16b60b37d21e85a3cccbae82a20c14#fe1ad0d573be637bf03fc59bb4402997bdd31b40_15_15)
ghost1 commented 2026-06-13 13:34:45 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 05e6fad0 - fix(security): exclude only BIP39 fixture from gitleaks scan (#380)

Compare with previous version

added 1 commit <ul><li>05e6fad0 - fix(security): exclude only BIP39 fixture from gitleaks scan (#380)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850334932&start_sha=67ed19662e16b60b37d21e85a3cccbae82a20c14)
ghost1 commented 2026-06-13 13:35:00 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-13 13:57:14 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 37791b9c - fix(ci): skip cargo-audit install when cache provides binary

Compare with previous version

added 1 commit <ul><li>37791b9c - fix(ci): skip cargo-audit install when cache provides binary</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850340452&start_sha=05e6fad0fb3b44509649988202171170238ed4aa)
ghost1 commented 2026-06-13 13:57:29 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-13 14:00:18 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 043ec246 - fix(ci): detect cached cargo-audit via CARGO_HOME path

Compare with previous version

added 1 commit <ul><li>043ec246 - fix(ci): detect cached cargo-audit via CARGO_HOME path</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850341183&start_sha=37791b9c0e1a5dc66525452d284a7281f08c0d35)
PlasticDigits commented 2026-06-13 14:00:29 +00:00 (Migrated from gitlab.com)

Severity: Medium — excluded fixture file bypasses mandatory CI gitleaks for non-BIP39 secrets

Issue: stage_tracked_tree skips the entire tracked file scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts (L15). Any other secret type appended to that file is never scanned by the mandatory CI job (M-13).

Impact: A contributor can commit API tokens or other credentials in the excluded fixture file and pass MR/default-branch gitleaks when pre-commit is skipped (--no-verify) or gitleaks is not installed locally.

Verified (image ghcr.io/gitleaks/gitleaks:v8.24.2, HEAD 37791b9c):

  • Append ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890 to bip39-violation.ts → ./scripts/ci/gitleaks-scan-tracked.sh exit 0 (no leaks)
  • Same token in tracked scripts/ci/gitleaks-fixture/gh-token-test.txt → exit 1 (github-pat detected)
  • Pre-commit-style gitleaks protect --staged on the modified fixture file → exit 1 (detected; hooks are best-effort only per docs)

Fix: Do not omit the whole file from the staged tree. Include it in the main scan and allowlist only the intentional BIP39 fingerprint/line (or scan with gitleaks-fixture.toml in verify-gitleaks.sh only, as today, while keeping the main config strict on that path).

**Severity: Medium** — excluded fixture file bypasses mandatory CI gitleaks for non-BIP39 secrets **Issue:** `stage_tracked_tree` skips the entire tracked file `scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts` (L15). Any other secret type appended to that file is never scanned by the mandatory CI job (M-13). **Impact:** A contributor can commit API tokens or other credentials in the excluded fixture file and pass MR/default-branch `gitleaks` when pre-commit is skipped (`--no-verify`) or gitleaks is not installed locally. **Verified** (image `ghcr.io/gitleaks/gitleaks:v8.24.2`, HEAD `37791b9c`): - Append `ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890` to `bip39-violation.ts` → `./scripts/ci/gitleaks-scan-tracked.sh` **exit 0** (no leaks) - Same token in tracked `scripts/ci/gitleaks-fixture/gh-token-test.txt` → **exit 1** (`github-pat` detected) - Pre-commit-style `gitleaks protect --staged` on the modified fixture file → **exit 1** (detected; hooks are best-effort only per docs) **Fix:** Do not omit the whole file from the staged tree. Include it in the main scan and allowlist only the intentional BIP39 fingerprint/line (or scan with `gitleaks-fixture.toml` in `verify-gitleaks.sh` only, as today, while keeping the main config strict on that path).
ghost1 commented 2026-06-13 14:00:34 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-13 14:00:36 +00:00 (Migrated from gitlab.com)

Security review — MR !904

Commit reviewed: 37791b9c0e1a5dc66525452d284a7281f08c0d35
Scope: .gitlab-ci.yml security stage (gitleaks, cargo-audit, npm audit), DinD TLS for qa-wasm-artifacts, scripts/ci/gitleaks-scan-tracked.sh, .gitleaks.toml, audit allowlists, lockfile bumps, supply-chain docs.

Outcome: FINDINGS: 1 medium

Findings

Sev Topic Location
Medium Whole-file fixture exclusion bypasses mandatory CI gitleaks for non-BIP39 secrets scripts/ci/gitleaks-scan-tracked.sh L15 — inline thread

Prior findings (resolved; not re-reported)

Sev Topic Status
High .gitleaks.toml directory-wide fixture path allowlist Fixed in e53ae252, superseded by tracked-only scan
High Fixture-tree prefix exclusion in gitleaks-scan-tracked.sh Fixed in 05e6fad0 (single-file exclusion only)
Medium gitleaks job missing merge_request_event Fixed in e53ae252
Medium Global dist/node_modules path allowlist bypass Fixed in 67ed1966 (tracked-only scan)
Medium Fixture path suffix allowlist bypass Fixed in 67ed1966
Medium Duplicate cd frontend-dapp in npm-audit-frontend Fixed in ae184f61

Notes

  • DinD TLS migration (2375 → 2376) and readiness loop are hardening; no issue found.
  • cargo-audit install guard (37791b9c) is a CI reliability fix; no new supply-chain exposure identified.
  • cargo-audit / npm audit allowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code.
  • Force-added secrets under tracked dist/ and suffix paths under frontend-dapp/src/ are detected (verified).

See inline thread for the open finding.

## Security review — MR !904 **Commit reviewed:** `37791b9c0e1a5dc66525452d284a7281f08c0d35` **Scope:** `.gitlab-ci.yml` security stage (gitleaks, cargo-audit, npm audit), DinD TLS for `qa-wasm-artifacts`, `scripts/ci/gitleaks-scan-tracked.sh`, `.gitleaks.toml`, audit allowlists, lockfile bumps, supply-chain docs. **Outcome:** `FINDINGS: 1` medium ### Findings | Sev | Topic | Location | |-----|-------|----------| | **Medium** | Whole-file fixture exclusion bypasses mandatory CI gitleaks for non-BIP39 secrets | `scripts/ci/gitleaks-scan-tracked.sh` L15 — inline thread | ### Prior findings (resolved; not re-reported) | Sev | Topic | Status | |-----|-------|--------| | High | `.gitleaks.toml` directory-wide fixture path allowlist | **Fixed** in `e53ae252`, superseded by tracked-only scan | | High | Fixture-tree prefix exclusion in `gitleaks-scan-tracked.sh` | **Fixed** in `05e6fad0` (single-file exclusion only) | | Medium | `gitleaks` job missing `merge_request_event` | **Fixed** in `e53ae252` | | Medium | Global `dist`/`node_modules` path allowlist bypass | **Fixed** in `67ed1966` (tracked-only scan) | | Medium | Fixture path suffix allowlist bypass | **Fixed** in `67ed1966` | | Medium | Duplicate `cd frontend-dapp` in `npm-audit-frontend` | **Fixed** in `ae184f61` | ### Notes - DinD TLS migration (`2375` → `2376`) and readiness loop are hardening; no issue found. - `cargo-audit` install guard (`37791b9c`) is a CI reliability fix; no new supply-chain exposure identified. - `cargo-audit` / `npm audit` allowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code. - Force-added secrets under tracked `dist/` and suffix paths under `frontend-dapp/src/` are detected (verified). See inline thread for the open finding.
PlasticDigits commented 2026-06-13 14:01:49 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-13 14:03:16 +00:00 (Migrated from gitlab.com)

Re-verified on 043ec246 — finding still applies.

Appending export const TOKEN = "ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890"; to the excluded fixture file and running ./scripts/ci/gitleaks-scan-tracked.sh returns exit 0 (no leaks). The mandatory CI job never inspects that tracked path.

Attack path: commit non-BIP39 credentials into scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts → MR/default-branch gitleaks passes when pre-commit is skipped or gitleaks is not installed locally.

Fix: include the file in the staged tree; allowlist only the known BIP39 line/fingerprint in .gitleaks.toml, or split fixture content so CI self-test uses gitleaks-fixture.toml without omitting the path from the main scan.

**Re-verified on `043ec246`** — finding still applies. Appending `export const TOKEN = "ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890";` to the excluded fixture file and running `./scripts/ci/gitleaks-scan-tracked.sh` returns **exit 0** (no leaks). The mandatory CI job never inspects that tracked path. **Attack path:** commit non-BIP39 credentials into `scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts` → MR/default-branch `gitleaks` passes when pre-commit is skipped or gitleaks is not installed locally. **Fix:** include the file in the staged tree; allowlist only the known BIP39 line/fingerprint in `.gitleaks.toml`, or split fixture content so CI self-test uses `gitleaks-fixture.toml` without omitting the path from the main scan.
PlasticDigits commented 2026-06-13 14:03:20 +00:00 (Migrated from gitlab.com)

Security review — MR !904

Commit reviewed: 043ec246cfa1bc38340ffe088c5318b0010aa7f6
Scope: .gitlab-ci.yml security stage (gitleaks, cargo-audit, npm audit), DinD TLS for qa-wasm-artifacts, scripts/ci/gitleaks-scan-tracked.sh, .gitleaks.toml, audit allowlists, lockfile bumps, supply-chain docs.

Outcome: FINDINGS: 1 medium

Findings

Sev Topic Location
Medium Whole-file fixture exclusion bypasses mandatory CI gitleaks for non-BIP39 secrets scripts/ci/gitleaks-scan-tracked.sh L15 — inline thread

Prior findings (resolved; not re-reported)

Sev Topic Status
High .gitleaks.toml directory-wide fixture path allowlist Fixed in e53ae252; superseded by tracked-only scan
High Fixture-tree prefix exclusion in gitleaks-scan-tracked.sh Fixed in 05e6fad0 (single-file exclusion only)
Medium gitleaks job missing merge_request_event Fixed in e53ae252
Medium Global dist/node_modules path allowlist bypass Fixed in 67ed1966 (tracked-only scan)
Medium Fixture path suffix allowlist bypass Fixed in 67ed1966
Medium Duplicate cd frontend-dapp in npm-audit-frontend Fixed in ae184f61

Notes

  • DinD TLS migration (2375 → 2376) and readiness loop are hardening; no issue found.
  • 043ec246 cargo-audit cache guard is a CI reliability fix; no new supply-chain exposure identified.
  • cargo-audit / npm audit allowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code.
  • Force-added secrets under tracked dist/ and suffix paths under frontend-dapp/src/ are detected (verified).
  • make verify-gitleaks passes on the clean tree; the open finding is an intentional-exclusion side effect.

See inline thread on scripts/ci/gitleaks-scan-tracked.sh L15.

## Security review — MR !904 **Commit reviewed:** `043ec246cfa1bc38340ffe088c5318b0010aa7f6` **Scope:** `.gitlab-ci.yml` security stage (gitleaks, cargo-audit, npm audit), DinD TLS for `qa-wasm-artifacts`, `scripts/ci/gitleaks-scan-tracked.sh`, `.gitleaks.toml`, audit allowlists, lockfile bumps, supply-chain docs. **Outcome:** `FINDINGS: 1` medium ### Findings | Sev | Topic | Location | |-----|-------|----------| | **Medium** | Whole-file fixture exclusion bypasses mandatory CI gitleaks for non-BIP39 secrets | `scripts/ci/gitleaks-scan-tracked.sh` L15 — inline thread | ### Prior findings (resolved; not re-reported) | Sev | Topic | Status | |-----|-------|--------| | High | `.gitleaks.toml` directory-wide fixture path allowlist | **Fixed** in `e53ae252`; superseded by tracked-only scan | | High | Fixture-tree prefix exclusion in `gitleaks-scan-tracked.sh` | **Fixed** in `05e6fad0` (single-file exclusion only) | | Medium | `gitleaks` job missing `merge_request_event` | **Fixed** in `e53ae252` | | Medium | Global `dist`/`node_modules` path allowlist bypass | **Fixed** in `67ed1966` (tracked-only scan) | | Medium | Fixture path suffix allowlist bypass | **Fixed** in `67ed1966` | | Medium | Duplicate `cd frontend-dapp` in `npm-audit-frontend` | **Fixed** in `ae184f61` | ### Notes - DinD TLS migration (`2375` → `2376`) and readiness loop are hardening; no issue found. - `043ec246` cargo-audit cache guard is a CI reliability fix; no new supply-chain exposure identified. - `cargo-audit` / `npm audit` allowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code. - Force-added secrets under tracked `dist/` and suffix paths under `frontend-dapp/src/` are detected (verified). - `make verify-gitleaks` passes on the clean tree; the open finding is an intentional-exclusion side effect. See inline thread on `scripts/ci/gitleaks-scan-tracked.sh` L15.
PlasticDigits commented 2026-06-13 14:16:11 +00:00 (Migrated from gitlab.com)

changed this line in version 9 of the diff

changed this line in [version 9 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850346280&start_sha=043ec246cfa1bc38340ffe088c5318b0010aa7f6#fe1ad0d573be637bf03fc59bb4402997bdd31b40_15_14)
PlasticDigits commented 2026-06-13 14:16:11 +00:00 (Migrated from gitlab.com)

added 1 commit

  • ee48a047 - fix(security): scan BIP39 fixture file with phrase-only allowlist (#380)

Compare with previous version

added 1 commit <ul><li>ee48a047 - fix(security): scan BIP39 fixture file with phrase-only allowlist (#380)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850346280&start_sha=043ec246cfa1bc38340ffe088c5318b0010aa7f6)
PlasticDigits commented 2026-06-13 14:16:15 +00:00 (Migrated from gitlab.com)

Security fixes (ee48a047)

Finding Severity Fix
Whole-file fixture exclusion in gitleaks-scan-tracked.sh bypasses mandatory CI gitleaks for non-BIP39 secrets Medium Fixed. Removed the bip39-violation.ts skip in stage_tracked_tree; the fixture is now included in the tracked scan. Added a rule-level regex allowlist in .gitleaks.toml for only the known test mnemonic (abandon … about), not the file path — so appended API tokens or other secrets in that file are detected (verified: ghp_… in fixture → exit 1; clean tree + make verify-gitleaks → pass).

Prior findings (already resolved on branch; unchanged)

  • High: .gitleaks.toml directory-wide fixture path allowlist — fixed in e53ae252
  • High: Fixture-tree prefix exclusion — fixed in 05e6fad0, superseded by this phrase-only allowlist
  • Medium: gitleaks missing MR rules — fixed in e53ae252
  • Medium: Global dist/node_modules path allowlist bypass — fixed in 67ed1966
  • Medium: Duplicate cd frontend-dapp in npm-audit-frontend — fixed in ae184f61

All low+ review findings addressed.

## Security fixes (`ee48a047`) | Finding | Severity | Fix | |---------|----------|-----| | Whole-file fixture exclusion in `gitleaks-scan-tracked.sh` bypasses mandatory CI gitleaks for non-BIP39 secrets | **Medium** | **Fixed.** Removed the `bip39-violation.ts` skip in `stage_tracked_tree`; the fixture is now included in the tracked scan. Added a rule-level regex allowlist in `.gitleaks.toml` for only the known test mnemonic (`abandon … about`), not the file path — so appended API tokens or other secrets in that file are detected (verified: `ghp_…` in fixture → exit 1; clean tree + `make verify-gitleaks` → pass). | ### Prior findings (already resolved on branch; unchanged) - High: `.gitleaks.toml` directory-wide fixture path allowlist — fixed in `e53ae252` - High: Fixture-tree prefix exclusion — fixed in `05e6fad0`, superseded by this phrase-only allowlist - Medium: `gitleaks` missing MR rules — fixed in `e53ae252` - Medium: Global `dist`/`node_modules` path allowlist bypass — fixed in `67ed1966` - Medium: Duplicate `cd frontend-dapp` in `npm-audit-frontend` — fixed in `ae184f61` All low+ review findings addressed.
ghost1 commented 2026-06-13 14:16:19 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-13 14:16:32 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-13 14:18:07 +00:00 (Migrated from gitlab.com)
Stale Security Review comment

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit ee48a04720. Configure here.

<details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ee48a04720f5d38175ccd64486072e5176fb399b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details>
ghost1 commented 2026-06-13 14:18:08 +00:00 (Migrated from gitlab.com)

Test phrase allowlists real frontend paths

Medium Severity

The new rule-level regexes allowlist for the standard test mnemonic applies to every path that matches bip39-like-phrase-frontend-src, not only the CI fixture. The same quoted phrase in frontend-dapp/src no longer trips the custom rule, weakening the #118 dev-mnemonic gate while default rules still miss BIP39-shaped strings.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ee48a04720. Configure here.

### Test phrase allowlists real frontend paths **Medium Severity** <!-- DESCRIPTION START --> The new rule-level `regexes` allowlist for the standard test mnemonic applies to every path that matches `bip39-like-phrase-frontend-src`, not only the CI fixture. The same quoted phrase in `frontend-dapp/src` no longer trips the custom rule, weakening the #118 dev-mnemonic gate while default rules still miss BIP39-shaped strings. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 7b13ecf4-c9e5-41ce-b40d-22ec9c047a45 --> <!-- LOCATIONS START .gitleaks.toml#L17-L21 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjE0NDY5ZjNhLWU0NDMtNGM3NC1iMjQ5LWMyYTQwZmVmZWNjNiIsImVuY3J5cHRpb25LZXkiOiJUQ01EN2V2UWhpZWNQTFBvcktPUVZ6ZU1OWE01c0w2a2VnY05OTjNtTENzIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjE0NDY5ZjNhLWU0NDMtNGM3NC1iMjQ5LWMyYTQwZmVmZWNjNiIsImVuY3J5cHRpb25LZXkiOiJUQ01EN2V2UWhpZWNQTFBvcktPUVZ6ZU1OWE01c0w2a2VnY05OTjNtTENzIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjoxODYsImNvbW1pdFNoYSI6ImVlNDhhMDQ3MjBmNWQzODE3NWNjZDY0NDg2MDcyZTUxNzZmYjM5OWIiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ee48a04720f5d38175ccd64486072e5176fb399b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-13 14:19:42 +00:00 (Migrated from gitlab.com)

Security review — MR !904

Commit reviewed: ee48a04720f5d38175ccd64486072e5176fb399b
Scope: .gitlab-ci.yml security stage (gitleaks, cargo-audit, npm audit), DinD TLS for qa-wasm-artifacts, scripts/ci/gitleaks-scan-tracked.sh, .gitleaks.toml, audit allowlists, lockfile bumps, supply-chain docs.

Outcome: FINDINGS: 0 — Security review: no medium+ findings on this diff.

Verification (local, image ghcr.io/gitleaks/gitleaks:v8.24.2)

Check Result
make verify-gitleaks on clean tree PASS
Append ghp_… to tracked fixture bip39-violation.ts → gitleaks-scan-tracked.sh FAIL (leak detected)
Second BIP39 mnemonic alongside allowlisted test phrase in frontend-dapp/src/ FAIL (leak detected)
ghp_… under scripts/ci/gitleaks-fixture/ (non-fixture path) FAIL (leak detected)
BIP39 mnemonic in scripts/ci/gitleaks-fixture/frontend-dapp/src/other.ts FAIL (leak detected)

Prior findings (resolved; not re-reported)

Sev Topic Status
High .gitleaks.toml directory-wide fixture path allowlist Fixed e53ae252; superseded by tracked-only scan
High Fixture-tree prefix exclusion in gitleaks-scan-tracked.sh Fixed 05e6fad0
Medium gitleaks job missing merge_request_event Fixed e53ae252
Medium Global dist/node_modules path allowlist bypass Fixed 67ed1966 (tracked-only scan)
Medium Fixture path suffix allowlist bypass Fixed 67ed1966
Medium Whole-file fixture exclusion bypasses non-BIP39 secrets Fixed ee48a047 (phrase-only regex allowlist; verified above)
Medium Duplicate cd frontend-dapp in npm-audit-frontend Fixed ae184f61

Notes

  • DinD TLS migration (2375 → 2376) and readiness loop are hardening; no issue found.
  • cargo-audit cache guard and pinned GITLEAKS_IMAGE are CI reliability/supply-chain hygiene; no new exploitable runtime paths identified.
  • cargo-audit / npm audit allowlists and lockfile bumps are documented accepted-risk or patch upgrades.
  • No inline threads — zero open medium+ findings.
## Security review — MR !904 **Commit reviewed:** `ee48a04720f5d38175ccd64486072e5176fb399b` **Scope:** `.gitlab-ci.yml` security stage (gitleaks, cargo-audit, npm audit), DinD TLS for `qa-wasm-artifacts`, `scripts/ci/gitleaks-scan-tracked.sh`, `.gitleaks.toml`, audit allowlists, lockfile bumps, supply-chain docs. **Outcome:** `FINDINGS: 0` — **Security review: no medium+ findings on this diff.** ### Verification (local, image `ghcr.io/gitleaks/gitleaks:v8.24.2`) | Check | Result | |-------|--------| | `make verify-gitleaks` on clean tree | **PASS** | | Append `ghp_…` to tracked fixture `bip39-violation.ts` → `gitleaks-scan-tracked.sh` | **FAIL** (leak detected) | | Second BIP39 mnemonic alongside allowlisted test phrase in `frontend-dapp/src/` | **FAIL** (leak detected) | | `ghp_…` under `scripts/ci/gitleaks-fixture/` (non-fixture path) | **FAIL** (leak detected) | | BIP39 mnemonic in `scripts/ci/gitleaks-fixture/frontend-dapp/src/other.ts` | **FAIL** (leak detected) | ### Prior findings (resolved; not re-reported) | Sev | Topic | Status | |-----|-------|--------| | High | `.gitleaks.toml` directory-wide fixture path allowlist | **Fixed** `e53ae252`; superseded by tracked-only scan | | High | Fixture-tree prefix exclusion in `gitleaks-scan-tracked.sh` | **Fixed** `05e6fad0` | | Medium | `gitleaks` job missing `merge_request_event` | **Fixed** `e53ae252` | | Medium | Global `dist`/`node_modules` path allowlist bypass | **Fixed** `67ed1966` (tracked-only scan) | | Medium | Fixture path suffix allowlist bypass | **Fixed** `67ed1966` | | Medium | Whole-file fixture exclusion bypasses non-BIP39 secrets | **Fixed** `ee48a047` (phrase-only regex allowlist; verified above) | | Medium | Duplicate `cd frontend-dapp` in `npm-audit-frontend` | **Fixed** `ae184f61` | ### Notes - DinD TLS migration (`2375` → `2376`) and readiness loop are hardening; no issue found. - `cargo-audit` cache guard and pinned `GITLEAKS_IMAGE` are CI reliability/supply-chain hygiene; no new exploitable runtime paths identified. - `cargo-audit` / `npm audit` allowlists and lockfile bumps are documented accepted-risk or patch upgrades. - No inline threads — zero open medium+ findings.
ghost1 commented 2026-06-13 14:19:42 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 3da6175e - fix(security): allowlist BIP39 fixture by path not phrase (#380)

Compare with previous version

added 1 commit <ul><li>3da6175e - fix(security): allowlist BIP39 fixture by path not phrase (#380)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850347592&start_sha=ee48a04720f5d38175ccd64486072e5176fb399b)
ghost1 commented 2026-06-13 14:19:56 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-13 14:20:35 +00:00 (Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit 3da6175e49. Configure here.

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTphNTBmZTFkMS1mZmU5LTQ2MTItODAwMy0xYjNkZTcxMjBkNjgiLCJlbmNyeXB0aW9uS2V5IjoidkVLejBwdWVlR0RiUG4xWmU3ZnJnR3FIM0lHWUs0RVJhMWd4WUNYVXZQMCIsImJyYW5jaCI6Imlzc3VlLTM4MC1jaS1zdXBwbHktY2hhaW4tc2VjdXJpdHkiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 3da6175e4929f38b0aac8d1c93ab49248de8ec2e. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-13 14:20:36 +00:00 (Migrated from gitlab.com)

Fixture path allowlist bypasses BIP39

Medium Severity

The incremental change replaces a rule-level regex allowlist for the known test mnemonic with a path allowlist on scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts. That disables the custom bip39-like-phrase-frontend-src rule for the entire file, so any other quoted 12+ word seed in that tracked path can pass mandatory CI gitleaks while generic default rules still miss BIP39-shaped secrets.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 3da6175e49. Configure here.

### Fixture path allowlist bypasses BIP39 **Medium Severity** <!-- DESCRIPTION START --> The incremental change replaces a rule-level regex allowlist for the known test mnemonic with a path allowlist on `scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts`. That disables the custom `bip39-like-phrase-frontend-src` rule for the entire file, so any other quoted 12+ word seed in that tracked path can pass mandatory CI gitleaks while generic default rules still miss BIP39-shaped secrets. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: eec23f52-e2be-48c3-93ce-a3126e34bd17 --> <!-- LOCATIONS START .gitleaks.toml#L11-L17 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjNmNzJhZDhiLTNiYTYtNDdlOS04YmE2LWNjZjNiZWVhNTEwYiIsImVuY3J5cHRpb25LZXkiOiI1THdJdGhralZaQlMteXkzRTRnTXJJV3hiMWVJdzh2dFNwa2V5OXBWQmZFIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjNmNzJhZDhiLTNiYTYtNDdlOS04YmE2LWNjZjNiZWVhNTEwYiIsImVuY3J5cHRpb25LZXkiOiI1THdJdGhralZaQlMteXkzRTRnTXJJV3hiMWVJdzh2dFNwa2V5OXBWQmZFIiwiYnJhbmNoIjoiaXNzdWUtMzgwLWNpLXN1cHBseS1jaGFpbi1zZWN1cml0eSIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjoxODYsImNvbW1pdFNoYSI6IjNkYTYxNzVlNDkyOWYzOGIwYWFjOGQxYzkzYWI0OTI0OGRlOGVjMmUiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 3da6175e4929f38b0aac8d1c93ab49248de8ec2e. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-13 14:22:35 +00:00 (Migrated from gitlab.com)

changed this file in version 11 of the diff

changed this file in version 11 of the diff
ghost1 commented 2026-06-13 14:22:35 +00:00 (Migrated from gitlab.com)

changed this line in version 11 of the diff

changed this line in [version 11 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850348613&start_sha=3da6175e4929f38b0aac8d1c93ab49248de8ec2e#54a6edd84cf35001d6e7c047af8b13b63ca40809_17_17)
ghost1 commented 2026-06-13 14:22:36 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 92ade2e5 - fix(security): restore phrase-only allowlist for BIP39 fixture (#380)

Compare with previous version

added 1 commit <ul><li>92ade2e5 - fix(security): restore phrase-only allowlist for BIP39 fixture (#380)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/186/diffs?diff_id=1850348613&start_sha=3da6175e4929f38b0aac8d1c93ab49248de8ec2e)
ghost1 commented 2026-06-13 14:22:51 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits (Migrated from gitlab.com) merged commit 84332f8cce into main 2026-06-14 02:53:36 +00:00
PlasticDigits commented 2026-06-14 02:53:37 +00:00 (Migrated from gitlab.com)

mentioned in commit 84332f8cce

mentioned in commit 84332f8cce137fd5260768b45b32853b48b43c05
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-dex-terraclassic!904
No description provided.