CI supply chain: SCA, gitleaks, DinD TLS (#380) #904
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic!904
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "issue-380-ci-supply-chain-security"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Adds a GitLab CI
securitystage for issue #380 (parent #376): mandatory gitleaks,cargo audit(smartcontracts + indexer with.cargo/audit.tomlallowlists),npm audit --audit-level=high --omit=dev, and DinD TLS (DOCKER_HOST=tcp://docker:2376) forqa-wasm-artifacts. Documents acceptedelliptictransitive risk (L-12) and local mirror targets indocs/supply-chain-security.md+skills/AGENTS_SUPPLY_CHAIN_SECURITY.md.Also applies
npm audit fixfor high-severity runtime advisories andcargo updatefor indexerrustls-webpki/time.Verify pass (2026-06-13): Fixed
cargo-audit-*CI install guard — cached binary under${CARGO_HOME}/binis detected viatest -x(notcommand -v, which missed cache path). MR pipeline 2599023634 green on security stage.Acceptance checklist
.gitlab-ci.ymljobs +smartcontracts/.cargo/audit.toml,indexer/.cargo/audit.toml;make audit-smartcontracts,make audit-indexer,make audit-frontend.gitleaks.tomlpatternsgitleaksjob (noallow_failure);make verify-gitleaks(fixture fails, clean tree passes); CIgitleakssuccessqa-wasm-artifactsgreen.gitlab-ci.ymlL12–16, readiness loop L119–130; noDOCKER_TLS_CERTDIR: ""webon main); verify after merge via manual web triggerdocs/supply-chain-security.md§ Accepted runtime riskVerification checklist (issue #380)
.gitlab-ci.ymlgitleaks,cargo-audit-*,npm-audit-frontendjobs; noallow_failure.security-rules-default-branchrulesmake audit-smartcontractscargo audit --deny warnings+ allowlistmake audit-indexermake audit-frontendnpm audit --audit-level=high --omit=dev(moderate elliptic only)make verify-gitleaksbip39-like-phrase-frontend-src; tracked tree cleanqa-wasm-artifactsDinD TLS + wasm buildglab ci runon feature branch → empty pipeline; needs post-mergewebtrigger onmaindocs/testing.md,docs/supply-chain-security.md,skills/AGENTS_SUPPLY_CHAIN_SECURITY.mdFollow-ups
main, run a manual web pipeline to confirmqa-wasm-artifactswith DinD TLS produces wasm artifacts.ellipticadvisory (documented indocs/supply-chain-security.md).changed the description
changed the description
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
b2b9dd06d5. Configure here.Duplicate frontend directory change fails
Medium Severity
In
npm-audit-frontend,before_scriptalreadycds intofrontend-dappfornpm ci. GitLab runsbefore_scriptandscriptin the same shell, so the script’s secondcd frontend-dapplooks for a nested folder that is not there and the job exits beforenpm auditruns.Reviewed by Cursor Bugbot for commit
b2b9dd06d5. Configure here.changed this line in version 2 of the diff
added 1 commit
ae184f61- fix(ci): run npm audit from frontend-dapp cwd after npm ciCompare with previous version
resolved all threads
changed the description
Severity: High — gitleaks control bypass via over-broad fixture path allowlist
Issue: The global
[allowlist].pathsentryscripts/ci/gitleaks-fixture/excludes the entire directory tree from all gitleaks rules (defaults +bip39-like-phrase-frontend-src). Any contributor can add arbitrary secrets under this prefix and pass mandatory CI gitleaks (M-13).Impact: Wallet mnemonics, API tokens, or other credentials can be committed without tripping the #118 BIP39 rule or generic detectors, defeating the stated mandatory gate.
Verified: With image
ghcr.io/gitleaks/gitleaks:v8.24.2and this config:ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890inscripts/ci/gitleaks-fixture/gh-token.txt→ no leaksfrontend-dapp/src/gh-token.txt→ leak detected (github-pat)scripts/ci/gitleaks-fixture/frontend-dapp/src/leak-test.ts→ no leaksfrontend-dapp/src/leak-test.ts→ leak detectedFix: Do not path-allowlist the whole fixture tree in
.gitleaks.toml.verify-gitleaks.shalready scans the fixture with a separate minimal config (scripts/ci/gitleaks-fixture.toml); keep the main config strict and exclude only the single known test file (or relocate fixture outside the repo root scan).Severity: Medium — gitleaks not enforced on merge-request pipelines
Issue:
gitleaksextends.security-rules-default-branch, which only runs on$CI_DEFAULT_BRANCHandschedule. Unlikecargo-audit-*andnpm-audit-frontend, there is nomerge_request_eventrule.Impact: An MR that changes only application source (e.g.
frontend-dapp/src/**) without touching lockfiles,smartcontracts/**, orindexer/**runs zerosecuritystage jobs. A quoted dev mnemonic or other secret can merge with a green MR pipeline; detection waits until a default-branch pipeline (or never, if removed before that run and--no-gitleaves history unscaned).Attack path: Open MR adding
FAKE_DEV_SEED = "<12-word mnemonic>"underfrontend-dapp/src/→ MR pipeline has no gitleaks/audit jobs → merge → secret in public history.Fix: Add MR rules for
gitleaks(at minimum whenfrontend-dapp/**,.gitleaks.toml, or.gitlab-ci.ymlchange; preferably on every MR).Security review — MR !904
Commit reviewed:
b2b9dd06d5f83c71a1706af35564c63caf6919bdScope:
.gitlab-ci.ymlsecurity stage (gitleaks, cargo-audit, npm audit), DinD TLS forqa-wasm-artifacts,.gitleaks.tomlallowlists, CI helper scripts, lockfile bumps, supply-chain docs.Outcome:
FINDINGS: 2(1 high, 1 medium)Findings
scripts/ci/gitleaks-fixture/path allowlist bypasses mandatory gitleaks (incl. BIP39 rule).gitleaks.toml— inline threadgitleaksjob not scheduled on MR pipelines; source-only MRs can skip entiresecuritystage.gitlab-ci.yml— inline threadNotes
2375→2376) is a hardening change; no issue found with the readiness loop.cargo-audit/npm auditallowlists and lockfile bumps are documented accepted-risk / patch upgrades; no new exploitable runtime paths identified in application code.Please resolve or acknowledge inline threads before merge.
changed this line in version 3 of the diff
added 1 commit
e53ae252- fix(security): tighten gitleaks allowlist and run on MR pipelinesCompare with previous version
Security fixes (
e53ae252)scripts/ci/gitleaks-fixture/path allowlist bypasses all gitleaks rulesscripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.tsin.gitleaks.toml. Verified:ghp_…and BIP39-like phrases in other paths under the fixture tree are now detected.gitleaksjob not scheduled on MR pipelinesmerge_request_eventrule togitleaksin.gitlab-ci.ymlso every MR runs the mandatory scan.cd frontend-dappinnpm-audit-frontendae184f61—scriptrunsnpm auditfrom thebefore_scriptcwd.Verification:
make verify-gitleakspasses locally; manual abuse checks confirm fixture-dir bypass is closed.changed the description
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
e53ae25285. Configure here.Gitleaks fixture path suffix bypass
Medium Severity
The global allowlist entry for the CI fixture matches any scanned path whose string ends with
scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts, without requiring that prefix at the repository root. A file underfrontend-dapp/src/(where the BIP39 rule applies) can use that suffix and have quoted mnemonics skipped by mandatory gitleaks.Reviewed by Cursor Bugbot for commit
e53ae25285. Configure here.Severity: Medium — gitleaks bypass via global build-output path allowlist
Issue: The global
[allowlist].pathsregex(?:^|/)(?:target|node_modules|dist|coverage)(?:/|$)excludes all files under those directories from every gitleaks rule (defaults +bip39-like-phrase-frontend-src).Impact: A contributor can
git add -fa secret under e.g.frontend-dapp/dist/orfrontend-dapp/node_modules/and pass mandatory CI gitleaks (M-13). The prior fixture-directory bypass was tightened ine53ae252; this path class has the same effect for gitignored build dirs.Verified (image
ghcr.io/gitleaks/gitleaks:v8.24.2, config ate53ae252):ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890infrontend-dapp/dist/gh-token.txt→ no leaksfrontend-dapp/node_modules/.cache/token→ no leaksfrontend-dapp/src/gh-token.txt→ leak detected (github-pat)Fix: Do not globally allowlist entire build trees in
.gitleaks.toml. Prefer rule-scoped allowlists, a.gitleaksignorefor local-only scans, or restrict CI--sourceto tracked paths excluding build dirs (CI gitleaks job does not neednode_modules/distpresent).Security review — MR !904 (re-review)
Commit reviewed:
e53ae25285d87d2e263b7069d493f34fb43028e7Scope:
.gitlab-ci.ymlsecurity stage (gitleaks, cargo-audit, npm audit), DinD TLS forqa-wasm-artifacts,.gitleaks.tomlallowlists, CI helper scripts, lockfile bumps, supply-chain docs.Outcome:
FINDINGS: 1mediumPrior findings (resolved in
e53ae252)scripts/ci/gitleaks-fixture/directory path allowlist bypassed all rulesbip39-violation.ts; verifiedghp_…and extra BIP39 phrases elsewhere under fixture tree are now detectedgitleaksjob missingmerge_request_eventruleNew finding
dist/node_modules/target/coveragepath allowlist bypasses mandatory gitleaks for force-added secrets.gitleaks.toml— inline threadNotes
2375→2376) and readiness loop are hardening; no issue found.cargo-audit/npm auditallowlists and lockfile bumps (react-router,rustls-webpki, cosmes patch) are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code.npm-audit-frontendcwd fix (ae184f61) verified —scriptrunsnpm auditfrombefore_scriptcwd.See inline thread for the open finding.
changed this line in version 4 of the diff
added 1 commit
079b9885- fix: anchor gitleaks fixture allowlist to repo root (#380)Compare with previous version
changed the description
changed this line in version 5 of the diff
added 1 commit
67ed1966- fix(security): scan git-tracked files only for gitleaks (#380)Compare with previous version
Security fixes (
67ed1966)dist/node_modules/target/coveragepath allowlist bypasses mandatory gitleaks.gitleaks.toml. CI/local scans now stage git-tracked files viascripts/ci/gitleaks-scan-tracked.sh(excludes fixture tree + untracked build artifacts) so force-added secrets under build dirs are detected.frontend-dapp/src/are scanned and fail as expected.scripts/ci/gitleaks-fixture/directory allowlist bypasse53ae252; superseded by tracked-only scan (no fixture allowlist needed).gitleaksjob not on MR pipelinese53ae252.cd frontend-dappinnpm-audit-frontendae184f61.Verification:
make verify-gitleakspasses; manual abuse checks confirmghp_…infrontend-dapp/dist/and BIP39-like phrases under suffix paths are now detected.changed the description
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
67ed19662e. Configure here.Fixture tree skips mandatory gitleaks
High Severity
Mandatory CI gitleaks omits every git-tracked path under
scripts/ci/gitleaks-fixture/, not only the intentional BIP39 fixture. After removing.gitleaks.tomlpath allowlists, that prefix becomes a blind spot: generic and custom rules never run on other tracked files there, so credentials can land on the default branch when hooks are skipped.Reviewed by Cursor Bugbot for commit
67ed19662e. Configure here.Severity: High — mandatory gitleaks bypass via fixture-tree exclusion
Issue:
stage_tracked_treeskips every git-tracked path underscripts/ci/gitleaks-fixture/. After removing.gitleaks.tomlpath allowlists (67ed1966), this prefix is the only blind spot in the mandatory CI scan.Impact: Credentials committed under that directory pass
gitleakson default-branch and MR pipelines (M-13). Pre-commit is best-effort (gitleaksoptional locally; hooks can be skipped).Verified (image
ghcr.io/gitleaks/gitleaks:v8.24.2, HEAD67ed1966):ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890in trackedscripts/ci/gitleaks-fixture/gh-token-test.txt→ no leaks (CI scan exit 0)frontend-dapp/src/gh-token-test.txt→ leak detected (github-pat, exit 1)scripts/ci/gitleaks-fixture/frontend-dapp/src/extra-leak.ts→ no leaksfrontend-dapp/src/→ leak detected (bip39-like-phrase-frontend-src)Attack path: Add secret file under
scripts/ci/gitleaks-fixture/(path is documented in supply-chain docs) → MR/default-branchgitleaksjob green → secret in public git history.Fix: Do not exclude the whole fixture tree from the main scan. Options: (a) scan fixture with main config but allowlist only
bip39-violation.tsvia anchored full path; (b) keep fixture outside repo root forverify-gitleaksonly; (c) scan fixture separately in CI withgitleaks-fixture.tomland fail on any additional leaks beyond the known violation file.Security review — MR !904
Commit reviewed:
67ed19662e16b60b37d21e85a3cccbae82a20c14Scope:
.gitlab-ci.ymlsecurity stage (gitleaks, cargo-audit, npm audit), DinD TLS forqa-wasm-artifacts,scripts/ci/gitleaks-scan-tracked.sh,.gitleaks.toml, audit allowlists, lockfile bumps, supply-chain docs.Outcome:
FINDINGS: 1(1 high)Findings
gitleaks-scan-tracked.shbypasses mandatory CI gitleaks for any secret underscripts/ci/gitleaks-fixture/scripts/ci/gitleaks-scan-tracked.shL15 — inline threadPrior findings (resolved; not re-reported)
.gitleaks.tomldirectory-wide fixture path allowliste53ae252, superseded by tracked-only scangitleaksjob missingmerge_request_evente53ae252dist/node_modulespath allowlist bypass67ed1966(tracked-only scan)67ed1966(no path allowlists remain)cd frontend-dappinnpm-audit-frontendae184f61Notes
2375→2376) and readiness loop are hardening; no issue found.cargo-audit/npm auditallowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code.make verify-gitleakspasses on the clean tree; the open finding is an intentional-exclusion side effect, not a false positive in the fixture self-test.See inline thread for the open finding.
changed this line in version 6 of the diff
changed this line in version 6 of the diff
added 1 commit
05e6fad0- fix(security): exclude only BIP39 fixture from gitleaks scan (#380)Compare with previous version
changed the description
added 1 commit
37791b9c- fix(ci): skip cargo-audit install when cache provides binaryCompare with previous version
changed the description
added 1 commit
043ec246- fix(ci): detect cached cargo-audit via CARGO_HOME pathCompare with previous version
Severity: Medium — excluded fixture file bypasses mandatory CI gitleaks for non-BIP39 secrets
Issue:
stage_tracked_treeskips the entire tracked filescripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts(L15). Any other secret type appended to that file is never scanned by the mandatory CI job (M-13).Impact: A contributor can commit API tokens or other credentials in the excluded fixture file and pass MR/default-branch
gitleakswhen pre-commit is skipped (--no-verify) or gitleaks is not installed locally.Verified (image
ghcr.io/gitleaks/gitleaks:v8.24.2, HEAD37791b9c):ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890tobip39-violation.ts→./scripts/ci/gitleaks-scan-tracked.shexit 0 (no leaks)scripts/ci/gitleaks-fixture/gh-token-test.txt→ exit 1 (github-patdetected)gitleaks protect --stagedon the modified fixture file → exit 1 (detected; hooks are best-effort only per docs)Fix: Do not omit the whole file from the staged tree. Include it in the main scan and allowlist only the intentional BIP39 fingerprint/line (or scan with
gitleaks-fixture.tomlinverify-gitleaks.shonly, as today, while keeping the main config strict on that path).changed the description
Security review — MR !904
Commit reviewed:
37791b9c0e1a5dc66525452d284a7281f08c0d35Scope:
.gitlab-ci.ymlsecurity stage (gitleaks, cargo-audit, npm audit), DinD TLS forqa-wasm-artifacts,scripts/ci/gitleaks-scan-tracked.sh,.gitleaks.toml, audit allowlists, lockfile bumps, supply-chain docs.Outcome:
FINDINGS: 1mediumFindings
scripts/ci/gitleaks-scan-tracked.shL15 — inline threadPrior findings (resolved; not re-reported)
.gitleaks.tomldirectory-wide fixture path allowliste53ae252, superseded by tracked-only scangitleaks-scan-tracked.sh05e6fad0(single-file exclusion only)gitleaksjob missingmerge_request_evente53ae252dist/node_modulespath allowlist bypass67ed1966(tracked-only scan)67ed1966cd frontend-dappinnpm-audit-frontendae184f61Notes
2375→2376) and readiness loop are hardening; no issue found.cargo-auditinstall guard (37791b9c) is a CI reliability fix; no new supply-chain exposure identified.cargo-audit/npm auditallowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code.dist/and suffix paths underfrontend-dapp/src/are detected (verified).See inline thread for the open finding.
changed the description
Re-verified on
043ec246— finding still applies.Appending
export const TOKEN = "ghp_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890";to the excluded fixture file and running./scripts/ci/gitleaks-scan-tracked.shreturns exit 0 (no leaks). The mandatory CI job never inspects that tracked path.Attack path: commit non-BIP39 credentials into
scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts→ MR/default-branchgitleakspasses when pre-commit is skipped or gitleaks is not installed locally.Fix: include the file in the staged tree; allowlist only the known BIP39 line/fingerprint in
.gitleaks.toml, or split fixture content so CI self-test usesgitleaks-fixture.tomlwithout omitting the path from the main scan.Security review — MR !904
Commit reviewed:
043ec246cfa1bc38340ffe088c5318b0010aa7f6Scope:
.gitlab-ci.ymlsecurity stage (gitleaks, cargo-audit, npm audit), DinD TLS forqa-wasm-artifacts,scripts/ci/gitleaks-scan-tracked.sh,.gitleaks.toml, audit allowlists, lockfile bumps, supply-chain docs.Outcome:
FINDINGS: 1mediumFindings
scripts/ci/gitleaks-scan-tracked.shL15 — inline threadPrior findings (resolved; not re-reported)
.gitleaks.tomldirectory-wide fixture path allowliste53ae252; superseded by tracked-only scangitleaks-scan-tracked.sh05e6fad0(single-file exclusion only)gitleaksjob missingmerge_request_evente53ae252dist/node_modulespath allowlist bypass67ed1966(tracked-only scan)67ed1966cd frontend-dappinnpm-audit-frontendae184f61Notes
2375→2376) and readiness loop are hardening; no issue found.043ec246cargo-audit cache guard is a CI reliability fix; no new supply-chain exposure identified.cargo-audit/npm auditallowlists and lockfile bumps are documented accepted-risk or patch upgrades; no new exploitable runtime paths in application code.dist/and suffix paths underfrontend-dapp/src/are detected (verified).make verify-gitleakspasses on the clean tree; the open finding is an intentional-exclusion side effect.See inline thread on
scripts/ci/gitleaks-scan-tracked.shL15.changed this line in version 9 of the diff
added 1 commit
ee48a047- fix(security): scan BIP39 fixture file with phrase-only allowlist (#380)Compare with previous version
Security fixes (
ee48a047)gitleaks-scan-tracked.shbypasses mandatory CI gitleaks for non-BIP39 secretsbip39-violation.tsskip instage_tracked_tree; the fixture is now included in the tracked scan. Added a rule-level regex allowlist in.gitleaks.tomlfor only the known test mnemonic (abandon … about), not the file path — so appended API tokens or other secrets in that file are detected (verified:ghp_…in fixture → exit 1; clean tree +make verify-gitleaks→ pass).Prior findings (already resolved on branch; unchanged)
.gitleaks.tomldirectory-wide fixture path allowlist — fixed ine53ae25205e6fad0, superseded by this phrase-only allowlistgitleaksmissing MR rules — fixed ine53ae252dist/node_modulespath allowlist bypass — fixed in67ed1966cd frontend-dappinnpm-audit-frontend— fixed inae184f61All low+ review findings addressed.
changed the description
changed the description
Stale Security Review comment
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
ee48a04720. Configure here.Test phrase allowlists real frontend paths
Medium Severity
The new rule-level
regexesallowlist for the standard test mnemonic applies to every path that matchesbip39-like-phrase-frontend-src, not only the CI fixture. The same quoted phrase infrontend-dapp/srcno longer trips the custom rule, weakening the #118 dev-mnemonic gate while default rules still miss BIP39-shaped strings.Reviewed by Cursor Bugbot for commit
ee48a04720. Configure here.Security review — MR !904
Commit reviewed:
ee48a04720f5d38175ccd64486072e5176fb399bScope:
.gitlab-ci.ymlsecurity stage (gitleaks, cargo-audit, npm audit), DinD TLS forqa-wasm-artifacts,scripts/ci/gitleaks-scan-tracked.sh,.gitleaks.toml, audit allowlists, lockfile bumps, supply-chain docs.Outcome:
FINDINGS: 0— Security review: no medium+ findings on this diff.Verification (local, image
ghcr.io/gitleaks/gitleaks:v8.24.2)make verify-gitleakson clean treeghp_…to tracked fixturebip39-violation.ts→gitleaks-scan-tracked.shfrontend-dapp/src/ghp_…underscripts/ci/gitleaks-fixture/(non-fixture path)scripts/ci/gitleaks-fixture/frontend-dapp/src/other.tsPrior findings (resolved; not re-reported)
.gitleaks.tomldirectory-wide fixture path allowliste53ae252; superseded by tracked-only scangitleaks-scan-tracked.sh05e6fad0gitleaksjob missingmerge_request_evente53ae252dist/node_modulespath allowlist bypass67ed1966(tracked-only scan)67ed1966ee48a047(phrase-only regex allowlist; verified above)cd frontend-dappinnpm-audit-frontendae184f61Notes
2375→2376) and readiness loop are hardening; no issue found.cargo-auditcache guard and pinnedGITLEAKS_IMAGEare CI reliability/supply-chain hygiene; no new exploitable runtime paths identified.cargo-audit/npm auditallowlists and lockfile bumps are documented accepted-risk or patch upgrades.added 1 commit
3da6175e- fix(security): allowlist BIP39 fixture by path not phrase (#380)Compare with previous version
changed the description
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
3da6175e49. Configure here.Fixture path allowlist bypasses BIP39
Medium Severity
The incremental change replaces a rule-level regex allowlist for the known test mnemonic with a path allowlist on
scripts/ci/gitleaks-fixture/frontend-dapp/src/bip39-violation.ts. That disables the custombip39-like-phrase-frontend-srcrule for the entire file, so any other quoted 12+ word seed in that tracked path can pass mandatory CI gitleaks while generic default rules still miss BIP39-shaped secrets.Reviewed by Cursor Bugbot for commit
3da6175e49. Configure here.changed this file in version 11 of the diff
changed this line in version 11 of the diff
added 1 commit
92ade2e5- fix(security): restore phrase-only allowlist for BIP39 fixture (#380)Compare with previous version
changed the description
mentioned in commit
84332f8cce