>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #969
Update issue details
Title *
Description
EARS SPEC: - The Highway CI secret scan shall fail on any credential added to tracked files or history, proven red on planted positives including an INI 'key = value' under a [secrets] section. - For each historical gitleaks finding, the triage shall record: file, commit, credential type, whether it is still live (checked without printing the value), owner, and action (rotate / revoked / false positive). - If a historical credential is still live, then it shall be reported to the owner for rotation; history rewriting is out of scope (owner decision). - The CI history scan shall use a reviewed baseline (.gitleaksignore fingerprints) so only new findings fail. CONTEXT: gitleaks 8.30.1 (sha256 551f6f...), full history: highway 45 findings (docker/.env.local x7, scripts/export-sonar-metrics.sh x5, api/screenshot_with_auth.sh jwt x3, test.env x3, .claude/settings.local.json x2, CLAUDE.md jwt, ...), highway-engine 8, jumper 0. Known miss: docker/config.ini [secrets] mail (81bb4b4..4ba5d88~1), a real SMTP password that authenticated until 2026-10-20 — not flagged by default rules.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel