verify: CI supply chain SCA, gitleaks, DinD TLS (#380) #908
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic!908
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "verify/issue-380-ci-supply-chain"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Verification of #380 found the acceptance criteria were not yet implemented on
main. This MR adds thesecurityCI stage, DinD TLS for wasm builds, documented audit allowlists, and supply-chain docs per #376 remediation (H-06, M-11, M-13, L-12).securitystage:gitleaks,cargo-audit-smartcontracts,cargo-audit-indexer,npm-audit-frontend— unconditional on default branch, notallow_failureqa-wasm-artifactsusesDOCKER_TLS_CERTDIR=/certs(encrypted port 2376) instead of cleartext2375smartcontracts/.cargo/audit.toml,indexer/.cargo/audit.toml;docs/supply-chain-security.mddocuments acceptedelliptictransitive risk (L-12)npm audit fix+ indexerrustls-webpki/timebumps so high-threshold audits passAcceptance checklist
cd smartcontracts && cargo audit --deny warnings→ exit 0;cd indexer && cargo audit --deny warnings→ exit 0;cd frontend-dapp && npm audit --audit-level=high --omit=dev→ exit 0; allowlists in.cargo/audit.toml+docs/supply-chain-security.md.gitlab-ci.ymlgitleaksjob extends.security_on_default_branch;./scripts/ci/gitleaks-detect.sh→ no leaks;./scripts/ci/test-gitleaks-fixture.sh→ exits 1 on dummy PATqa-wasm-artifactsgreenDOCKER_TLS_CERTDIR: "/certs"+until docker infoinqa-wasm-artifacts; full wasm job needs GitLab CICI_PIPELINE_SOURCE=webtrigger post-mergeellipticdocs/supply-chain-security.md§ Accepted dependency risksmainwith new security stageallow_failure: trueon gitleaks/audit jobs.gitlab-ci.yml— none setdocs/testing.md§ GitLab CI security jobs;docs/supply-chain-security.md§ Local commands.gitleaks.tomlpatterns (attack test)./scripts/ci/test-gitleaks-fixture.shnpm audit --audit-level=high --omit=devcurrently exit 0 after lockfile fixes; critical would fail at--audit-level=criticalTest plan
securityjobs greenCI_PIPELINE_SOURCE=webtrigger onqa-wasm-artifactsproduces wasm artifacts./scripts/ci/gitleaks-detect.sh, bothcargo audit,npm audit --audit-level=high --omit=devFollow-ups
ellipticwhen@cosmjs/*≥0.34 or cosmes fork updates the dependency chaincargo denyfor license/source duplication after audit baseline is stablechanged the description
changed the description
Severity: Medium
Issue: Global
[allowlist].pathsentry for(?:^|/)target/suppresses gitleaks detections for secrets committed under anytarget/tree during the CI git-range scan (scripts/ci/gitleaks-detect.shuses--log-opts, not--no-git).Impact: A contributor can
git add -f indexer/target/...orsmartcontracts/target/...(paths are.gitignored but force-addable) containing a GitHub PAT, deploy token, or mnemonic. The mandatory default-branchgitleaksjob exits 0 and the secret persists in git history.Evidence: Reproduced with gitleaks v8.21.2 (same image as CI): force-committed
ghp_<40hex>intarget/debug/leak.txtis flagged without the allowlist (leaks found: 1, exit 1) and passes with this allowlist (no leaks found, exit 0).node_modules/is already skipped for git-range scans when gitignored;target/is not—this entry newly weakens CI detection.Suggestion: Drop
target/from the global allowlist (keepnode_modules/only for--no-gitlocal scans if needed), or scope the allowlist to--no-gitvia a separate config file so CI git scans remain strict.Security review summary
Commit reviewed:
a776b93d508f8c3917c73aa020b373e936ece43bScope:
.gitlab-ci.ymlsecurity stage (gitleaks, cargo-audit, npm-audit), DinD TLS forqa-wasm-artifacts,.gitleaks.toml/scripts/ci/*,.cargo/audit.tomlallowlists, lockfile hygiene, supply-chain docs.Outcome:
FINDINGS: 1medium+Findings (inline)
target/path allowlist bypasses mandatory CI gitleaks for force-committed secrets.gitleaks.tomlline 30Reviewed, no medium+ issue
DOCKER_TLS_CERTDIR=/certs): Removes cleartext2375exposure; no new Docker API authz gap identified in this diff.CI_COMMIT_BEFORE_SHA..CI_COMMIT_SHA): Appropriate for post-#118 history; detects secrets in normal source paths on default-branch push.elliptic, Marvin RSA, cosmwasm transitives); lockfile bumps remediate actionable advisories rather than hiding runtime regressions.Please resolve the inline thread or adjust
.gitleaks.tomlbefore merge.changed this line in version 2 of the diff
added 1 commit
b6438bcf- fix(security): drop target/ from gitleaks path allowlistCompare with previous version
Security fixes (agent)
[allowlist].pathsentry for `(?:^suppressed gitleaks on force-committed secrets under*/target/` during CI git-range scansVerification: gitleaks v8.21.2 (CI image) now flags
ghp_*force-committed totarget/debug/leak.txtin a git-range scan (exit 1); repo scan and dummy-PAT fixture check still pass.All low+ findings from the prior review are resolved.
changed the description
Security review
Commit reviewed:
b6438bcf4cb6fe9f24deb365a25c0aefc9371691Scope
Reviewed MR !908 diff for supply-chain and CI security changes:
.gitlab-ci.yml— newsecuritystage (gitleaks,cargo-audit-smartcontracts,cargo-audit-indexer,npm-audit-frontend); DinD TLS hardening forqa-wasm-artifacts.gitleaks.toml— path allowlist configurationsmartcontracts/.cargo/audit.toml,indexer/.cargo/audit.toml— documented audit allowlistsscripts/ci/*— gitleaks and audit helper scriptsfrontend-dapp, indexer) supporting audit thresholdsdocs/supply-chain-security.md,docs/testing.mdOutcome
FINDINGS: 0 medium+ (NONE)
Prior finding — resolved and re-verified
A prior review flagged MEDIUM:
target/in.gitleaks.tomlpath allowlist could bypass CI gitleaks for force-committed secrets. Fixed inb6438bcfby removingtarget/from the allowlist (onlynode_modules/remains).Re-verified with gitleaks v8.21.2 (docker image) on git-range scans with current
.gitleaks.toml:ghp_*intarget/debug/leak.txt→ exit 1 (detected)ghp_*innode_modules/pkg/leak.txt→ exit 1 (detected)The
node_modules/allowlist does not bypass CI detection.Notes
scripts/ci/*.added 33 commits
maindd654b11- Merge branch 'main' into verify/issue-380-ci-supply-chainCompare with previous version
Resolved merge conflicts with
main(dd654b11).Conflicts resolved (7 files):
.gitlab-ci.yml,docs/supply-chain-security.md,docs/testing.md— tookmain(security stage, Makefile mirrors, MR change-gating already landed via #380 follow-ups)scripts/ci/gitleaks-detect.sh,smartcontracts/.cargo/audit.toml,indexer/.cargo/audit.toml,indexer/Cargo.lock— tookmainPreserved from this MR:
.gitleaks.toml—node_modules/path allowlist for local--no-gitscans; notarget/bypass (force-committed secrets under build dirs must still fail)Sanity:
gitleaks-scan-tracked.shandmake verify-gitleakspass locally.changed the description
Stale Security Review comment
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit
dd654b11f5. Configure here.WalletConnect empty on Vite builds
Medium Severity
WC_PROJECT_IDfalls back to the shared dev default only whenimport.meta.env.DEVis true, but that flag is false for everyvite build, includingmode=developmentorstaging. Non-production builds therefore embed an empty WalletConnect project id unlessVITE_WC_PROJECT_IDis set, whilevite.config.tsonly enforces that variable formode=production. Mobile WalletConnect controllers initialize with an empty id and fail at runtime on those artifacts.Reviewed by Cursor Bugbot for commit
dd654b11f5. Configure here.Severity: Medium
Issue: Global
[allowlist].pathsentry for(?:^|/)node_modules/suppresses gitleaks on force-committed secrets under*/node_modules/during CI scans.Impact: A contributor can
git add -f node_modules/.../leak.txtwith a real credential;scripts/ci/gitleaks-scan-tracked.shstages git-tracked files and runsgitleaks detect --no-gitwith this config. The path allowlist excludesnode_modules/from detection, so mandatory CI gitleaks passes (exit 0) while the secret remains in the default branch.Evidence (gitleaks v8.24.2, CI-equivalent staged-tree scan):
ghp_*innode_modules/pkg/leak.txtonly → exit 0 (not detected)target/debug/leak.txt→ exit 1 (detected)The comment that this allowlist is "for local
--no-gitscans only" does not hold: gitleaks path allowlists apply to all scans using.gitleaks.toml, including CI's staged tracked-tree scan.Suggested fix: Remove
node_modules/from the global path allowlist (same remediation as the priortarget/bypass). For noisy local working-tree scans, use a separate config or pass--no-gitonly overgit ls-filesoutput without path allowlisting dependency trees.Security review summary
Commit reviewed:
dd654b11f5c8209b4807562c2e34a2c9436e3ccdScope: Post-merge-conflict delta vs
main(4 files):.gitleaks.toml(node_modules/path allowlist),scripts/ci/test-gitleaks-fixture.sh,frontend-dapp/package-lock.json(dev toolchain bumps),skills/AGENTS_BUNDLE_DEV_WALLET.md. Re-checked CI security stage onmain(gitleaks tracked scan, cargo-audit, npm-audit, DinD TLS) for exploitability of MR-specific changes.Outcome:
FINDINGS: 1medium+Findings (inline)
node_modules/path allowlist bypasses mandatory CI gitleaks for force-committed secrets.gitleaks.tomlline 36Prior finding — resolved on branch
The earlier Medium
target/allowlist bypass was fixed inb6438bcfand remains resolved after the merge withmain.Reviewed, no new medium+ issue
DOCKER_TLS_CERTDIR=/certs): Already onmain; no new Docker API authz gap in this MR delta.scripts/ci/test-gitleaks-fixture.sh: Runtime-generated dummy PAT in a temp dir; no secret committed; correctly asserts non-zero exit.package-lock.jsondev bumps: esbuild/vitest/vite toolchain pins only (dev: true);npm audit --audit-level=high --omit=devscope unchanged.main; documented accepted risks only.Please resolve the inline thread or remove the
node_modules/global path allowlist before merge.changed this line in version 4 of the diff
added 1 commit
2887ec8d- fix(security): drop node_modules/ from gitleaks path allowlistCompare with previous version
Security fixes (agent)
[allowlist].pathsentry for `(?:^suppressed gitleaks on force-committed secrets under*/node_modules/during CI staged-tree scans (gitleaks-scan-tracked.sh`)[allowlist].pathsentry for `(?:^Verification:
make verify-gitleakspasses. Git-range scan with force-committedghp_*undertarget/debug/exits 1 (detected). Path allowlist no longer present to bypass CI gitleaks fornode_modules/ortarget/.All low+ findings from prior review are resolved.
Security review
Commit reviewed:
2887ec8d5544ed4f2f53af86c00ced07a0775df5Scope
MR !908 delta vs
main(4 files):.gitleaks.toml— comment clarifying no path allowlist fortarget//node_modules/scripts/ci/test-gitleaks-fixture.sh— runtime dummy-PAT fixture (no secret in git)frontend-dapp/package-lock.json— dev toolchain bumps (esbuild, vitest, etc.) fornpm audit --audit-level=high --omit=devskills/AGENTS_BUNDLE_DEV_WALLET.md— documents mandatory CI gitleaksRe-checked exploitability of CI security controls already on
main(gitleaks-scan-tracked.sh, cargo-audit, npm-audit, DinD TLS) against MR-specific changes.Outcome
FINDINGS: 0 medium+ (NONE)
Security review: no medium+ findings on this diff.
Prior findings — resolved and re-verified
target/path allowlist bypassed mandatory CI gitleaks for force-committed secretsb6438bcf); nopathsentry in current.gitleaks.tomlnode_modules/path allowlist bypassed CI staged-tree scans2887ec8d); path allowlist removedRe-verification (gitleaks
v8.24.2, CI image):ghp_*undertarget/debug/in a staged tree → exit 1 (detected)./scripts/ci/gitleaks-scan-tracked.shon current tree → exit 0 (clean)npm audit --audit-level=high --omit=dev→ exit 0 (no new high+ runtime advisories from lockfile bumps)Reviewed, no medium+ issue
test-gitleaks-fixture.sh: Generates ephemeral PAT-shaped test vector inmktempdir; cleans up on exit.SKIPwhen gitleaks binary absent is local-dev only — CI uses the pinned Docker image with gitleaks present.Inline threads
No new inline threads opened.
added 8 commits
main8acee13f- Merge branch 'main' into verify/issue-380-ci-supply-chainCompare with previous version
Resolved merge conflicts with
main(commit8acee13f).Conflict:
skills/AGENTS_BUNDLE_DEV_WALLET.md— both branches updated the rules-of-thumb list.Resolution: Kept
main's #378 production build guard (VITE_ALLOW_DEV_MNEMONIC) andVITE_WC_PROJECT_IDrequirement; retained this branch's #380 GitLab CIgitleaks-detect.shnote on the Gitleaks bullet.Local sanity:
./scripts/ci/gitleaks-detect.sh— no leaks.changed the description
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit
8acee13f41. Configure here.Staging builds keep permissive CSP
Medium Severity
The production CSP plugin only rewrites
index.htmlwhenmode === 'production'. Non-productionvite buildmodes (e.g. staging) ship the template meta policy with broadconnect-src(https:,wss:), instead of the env-scoped production policy fromviteCsp.ts.Reviewed by Cursor Bugbot for commit
8acee13f41. Configure here.Production CSP allows unsafe-inline scripts
Medium Severity
Production CSP meta content sets
script-srcto'self' 'unsafe-inline'. The priorbuildProductionCspinvite.config.tsusedscript-src 'self'only, and the removed Vitest guard explicitly expected productionscript-srcwithoutunsafe-inline.Reviewed by Cursor Bugbot for commit
8acee13f41. Configure here.Acceptable risk
Severity: Medium
Issue: Removing the custom
[allowlist].pathsentry fornode_modules/does not make force-committed secrets under*/node_modules/detectable in mandatory CI. With[extend] useDefault = true, gitleaks v8.24.2 still inherits the built-in global path allowlist that skipsnode_modules/.scripts/ci/gitleaks-scan-tracked.sh(the CI entrypoint) stages git-tracked files and runsgitleaks detect --no-git; secrets under trackednode_modules/paths are never scanned.Impact: A contributor can
git add -f frontend-dapp/node_modules/.../leak.txtcontaining a GitHub PAT, deploy token, or mnemonic. The default-branchgitleaksjob exits 0 and the secret persists in git history. This is the same abuse class as the priortarget/allowlist finding; removing only the repo-local path allowlist does not close it.Evidence (gitleaks
ghcr.io/gitleaks/gitleaks:v8.24.2, current.gitleaks.toml,scripts/ci/gitleaks-scan-tracked.sh):ghp_<40hex>atfrontend-dapp/node_modules/evil/leak.txt→ exit 0 (no leaks found)ghp_<40hex>attarget/debug/leak.txt→ exit 1 (leaks found: 1)useDefaultdetects both paths → exit 1Suggestion: Use a CI-specific gitleaks config (or override the inherited allowlist) so tracked
node_modules/paths are scanned, while keeping legitimate noise suppression for local working-tree scans if needed. Add amake verify-gitleaks/ CI regression that force-adds a dummy PAT undernode_modules/and asserts non-zero exit.Security review
Commit reviewed:
8acee13f41cf7e979d4afa57951ef0ca6573d04cScope
MR !908 delta vs
main(4 files):.gitleaks.toml— comment clarifying no repo-local path allowlist fortarget//node_modules/scripts/ci/test-gitleaks-fixture.sh— runtime dummy-PAT abuse check (not wired to CI;make verify-gitleaksusesscripts/ci/gitleaks-fixture/instead)frontend-dapp/package-lock.json— dev toolchain bumps (esbuild, vitest, vite, etc.) fornpm audit --audit-level=high --omit=devskills/AGENTS_BUNDLE_DEV_WALLET.md— documents mandatory CI gitleaksRe-checked exploitability of CI security controls on
main(gitleaks-scan-tracked.sh, cargo-audit, npm-audit, DinD TLS) against MR-specific changes and prior review threads.Outcome
FINDINGS: 1 medium+
useDefaultbuilt-innode_modules/path exclusion bypasses mandatory CI gitleaks for force-committed secrets.gitleaks.tomlline 26Prior findings — partial remediation
[allowlist].pathsfortarget/bypassed CI gitleaksb6438bcf);target/force-commits detected (exit 1)[allowlist].pathsfornode_modules/bypassed CI gitleaks2887ec8d), but gitleaksuseDefaultinherited global allowlist still skipsnode_modules/duringgitleaks-scan-tracked.shscansReviewed, no new medium+ issue
test-gitleaks-fixture.sh: Ephemeral PAT inmktempdir; cleans up on exit.SKIPwhen gitleaks binary absent is local-only (not in CI/Makefile).npm audit --audit-level=high --omit=devexits 0.Please resolve the inline thread or override the inherited
node_modules/path exclusion for CI scans before merge.changed this line in version 6 of the diff
added 1 commit
597ccc2d- fix(security): detect secrets in force-tracked node_modules pathsCompare with previous version
Security fixes (agent)
useDefaultbuilt-innode_modules/path exclusion bypassed mandatory CI gitleaks for force-committed secrets (gitleaks-scan-tracked.sh+--no-git)scripts/ci/gitleaks-scan-tracked.shremaps git-trackednode_modules/paths to_gitleaks-tracked/.../__tracked-nm__/...before scan so gitleaks’ inherited path allowlist cannot skip them (597ccc2d). Addedmake verify-gitleaksregression that force-adds a dummy PAT undernode_modules/and asserts non-zero exit. Updated.gitleaks.toml/docs/supply-chain-security.md.Prior findings — status
[allowlist].pathsfortarget/bypassed CI gitleaksb6438bcf)[allowlist].pathsfornode_modules/bypassed CI gitleaks2887ec8d+597ccc2dremap for built-in allowlist)unsafe-inlinescripts (Bugbot)Verification:
make verify-gitleaks— fixture fails, clean tree passes, force-trackednode_modules/PAT fails (exit 1).All low+ findings from prior review are resolved.
Severity: Medium
Issue:
ci_stage_dest_pathonly rewrites/node_modules/(mid-path) via${path//\/node_modules\//\/__tracked-nm__/}. Root-level tracked paths matchingnode_modules/*are prefixed with_gitleaks-tracked/but retain a leadingnode_modules/segment (e.g.node_modules/evil/leak.txt→_gitleaks-tracked/node_modules/evil/leak.txt). GitleaksuseDefaultbuilt-in path allowlist still skips these files.Impact: A contributor can
git add -f node_modules/leak.txt(root.gitignoreentry is force-addable) with a GitHub PAT, deploy token, or mnemonic. Mandatory default-branchgitleaks(scripts/ci/gitleaks-scan-tracked.sh) exits 0; the secret persists in git history. Same abuse class as the priornode_modules/bypass;make verify-gitleaksregression only coversfrontend-dapp/node_modules/....Evidence (gitleaks
ghcr.io/gitleaks/gitleaks:v8.24.2, current.gitleaks.toml,scripts/ci/gitleaks-scan-tracked.sh):ghp_<40hex>atnode_modules/evil/leak.txt→ exit 0 (no leaks found, ~0 bytes scanned)ghp_<40hex>atfrontend-dapp/node_modules/evil/leak.txt→ exit 1 (leaks found: 1)node_modules/evil/leak.txt→_gitleaks-tracked/node_modules/evil/leak.txt(allowlist still matches)Suggestion: Also rewrite a leading
node_modules/prefix (e.g.${path/#node_modules\//__tracked-nm__/}before or after the mid-path substitution), and extendmake verify-gitleakswith a root-levelnode_modules/force-add regression.Security review
Commit reviewed:
597ccc2d1b9a20eeb35a0ceac04ea71bd6c0d4b7Scope
MR !908 delta vs
main(7 files):scripts/ci/gitleaks-scan-tracked.sh— remap trackednode_modules/paths to defeat gitleaksuseDefaultbuilt-in path exclusionscripts/ci/verify-gitleaks.sh— force-trackednode_modules/regression test.gitleaks.toml— comment clarifying no repo-local path allowlist for build/dependency treesscripts/ci/test-gitleaks-fixture.sh— runtime dummy-PAT abuse check (not wired to CI/Makefile)frontend-dapp/package-lock.json— dev toolchain bumps fornpm audit --audit-level=high --omit=devdocs/supply-chain-security.md,skills/AGENTS_BUNDLE_DEV_WALLET.md— documentationRe-checked exploitability of prior review threads and CI security controls on current head.
Outcome
FINDINGS: 1 medium+
node_modules/*paths not remapped; built-in gitleaks path allowlist still bypasses mandatory CI scanscripts/ci/gitleaks-scan-tracked.shline 16Prior findings — status
[allowlist].pathsfortarget/bypassed CI gitleaksb6438bcf)node_modules/bypass forfrontend-dapp/node_modules/...597ccc2d); root-levelnode_modules/...still bypasses (see new finding)unsafe-inline(Bugbot)Reviewed, no new medium+ issue
verify-gitleaksregression: Correctly catchesfrontend-dapp/node_modules/force-adds; does not cover root-levelnode_modules/.test-gitleaks-fixture.sh: Ephemeral PAT inmktemp;SKIPwhen gitleaks absent is local-only (not in CI/Makefile).main; unchanged by this MR delta.Please resolve the inline thread or extend the remap to cover root-level
node_modules/before merge.added 1 commit
8e5eed8d- fix(security): remap root-level node_modules for gitleaks CI scanCompare with previous version
Security fixes (agent)
node_modules/*paths not remapped inci_stage_dest_path; gitleaksuseDefaultbuilt-in path allowlist still skipped force-committed secrets atnode_modules/...scripts/ci/gitleaks-scan-tracked.shnow rewrites a leadingnode_modules/prefix to__tracked-nm__/in addition to mid-path/node_modules/substitution (8e5eed8d). Extendedmake verify-gitleakswith a root-levelnode_modules/force-add regression. Updateddocs/supply-chain-security.md.Prior findings — status
[allowlist].pathsfortarget/bypassed CI gitleaksb6438bcf)node_modules/bypass for nested paths597ccc2d+8e5eed8droot-prefix remap)unsafe-inline(Bugbot)Verification:
make verify-gitleaks— fixture fails, clean tree passes, force-trackedfrontend-dapp/node_modules/PAT fails (exit 1), force-tracked rootnode_modules/PAT fails (exit 1).All low+ findings from prior review are resolved.
Severity: Medium
Issue:
ci_stage_dest_pathonly remaps paths matching*/node_modules/*ornode_modules/*. Tracked files whose path ends with anode_modulessegment (no trailing slash) are staged unchanged (e.g.evil/node_modules→evil/node_modules). GitleaksuseDefaultbuilt-in path allowlist skips these paths entirely.Impact: A contributor can
git add -f evil/node_modules(or rootnode_modules) containing a GitHub PAT, deploy token, or mnemonic. Mandatory default-branchgitleaks(scripts/ci/gitleaks-scan-tracked.sh) reportsscanned ~0 bytesand exits 0; the secret persists in git history. Same abuse class as priornode_modules/bypass findings;make verify-gitleaksregressions only cover.../node_modules/.../directory paths.Evidence (gitleaks
ghcr.io/gitleaks/gitleaks:v8.24.2, current.gitleaks.toml,scripts/ci/gitleaks-scan-tracked.sh):ghp_<40hex>atevil/node_modules(file) → exit 0 (scanned ~0 bytes,no leaks found)ghp_<40hex>atnode_modules(root file) → exit 0ghp_<40hex>atfrontend-dapp/node_modules/evil/leak.txt→ exit 1 (detected; remap works for directory paths)Suggestion: Extend the remap condition to also match terminal
node_modulessegments (e.g.*/node_modulesand exactnode_modules), rewrite those paths before scan, and add amake verify-gitleaksregression for a force-tracked file namednode_modules.Security review
Commit reviewed:
8e5eed8ddbd9763811e9693ad0c436741ddbd4d8Scope
MR !908 delta vs
main(7 files):scripts/ci/gitleaks-scan-tracked.sh— remap trackednode_modules/paths to defeat gitleaksuseDefaultbuilt-in path exclusionscripts/ci/verify-gitleaks.sh— force-trackednode_modules/regression tests (nested + root directory).gitleaks.toml— comment clarifying no repo-local path allowlist for build/dependency treesscripts/ci/test-gitleaks-fixture.sh— runtime dummy-PAT abuse check (not wired to CI/Makefile)frontend-dapp/package-lock.json— dev toolchain bumps fornpm audit --audit-level=high --omit=devdocs/supply-chain-security.md,skills/AGENTS_BUNDLE_DEV_WALLET.md— documentationRe-checked exploitability of prior review threads and CI security controls on current head.
Outcome
FINDINGS: 1 medium+
node_modulespath segment (file namednode_modules) not remapped; gitleaks built-in allowlist still bypasses mandatory CI scanscripts/ci/gitleaks-scan-tracked.shline 16Prior findings — status
[allowlist].pathsfortarget/bypassed CI gitleaksb6438bcf)node_modules/bypass for.../node_modules/.../directory paths597ccc2d+8e5eed8droot-prefix remap)unsafe-inline(Bugbot)Reviewed, no new medium+ issue
verify-gitleaksregressions: Correctly catchfrontend-dapp/node_modules/and rootnode_modules/directory force-adds; do not cover terminalnode_modulesfile paths.test-gitleaks-fixture.sh: Ephemeral PAT inmktemp;SKIPwhen gitleaks absent is local-only (not in CI/Makefile).npm audit --audit-level=high --omit=devexits 0; documentedellipticaccepted risk unchanged.main; unchanged by this MR delta.Please resolve the inline thread or extend the remap to cover terminal
node_modulespath segments before merge.Acceptable risk. A malicious actor can exhilarated data in a variety of ways
mentioned in commit
f5a0dc79d9