Compliance: open_secret_alerts

[don-petry]

Compliance Finding

Category: push-protection
Severity: error
Check: open_secret_alerts

Detail

16 open secret-scanning alert(s) — rotate the leaked credentials before resolving

Standard Reference

standards/push-protection.md#incident-response

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

All engines are currently rate-limited. Please re-apply the `dev-lead` label when the rate limit clears to retry.

[don-petry]

Weekly Compliance Audit (2026-06-19)

This finding is still open.

Detail: 16 open secret-scanning alert(s) — rotate the leaked credentials before resolving

Standard: standards/push-protection.md#incident-response

[don-petry]

Dev-Lead Implementation Plan

Issue: #630 — Compliance: open_secret_alerts

Root-Cause Analysis

All 16 open secret-scanning alerts are false positives. They are not real
credentials and there is nothing to rotate:

• Every alert points to a single file named gitleaks (a 21 MB ELF binary — the
  gitleaks scanner itself) at lines ~19407–19422, all in commit
  32c7ee52
  ("chore: apply manual instructions [skip ci-relay]").
• Inspecting the blob at those lines shows the flagged AIzaSy… strings live inside
  gitleaks' own embedded [[rules.allowlists]] — i.e. the scanner's built-in list of
  example Google API keys it uses to suppress its own test fixtures (e.g. the canonical
  AIzaSyabcdefghijklmnopqrstuvwxyz1234567).
• The binary was force-committed (it is gitignored — .gitignore line 402: /gitleaks,
  "downloaded fresh in CI, never committed") and has since been removed from HEAD. The
  alerts remain open only because the blob still exists in history.

Scope

Dismiss the 16 false-positive GitHub secret-scanning alerts (resolution false_positive)
so GET /secret-scanning/alerts?state=open returns an empty array, clearing the
open_secret_alerts compliance finding. No source change is required — recurrence is
already prevented by the existing /gitleaks .gitignore entry.

Remediation Checklist

• Confirm all 16 alerts resolve to gitleaks' embedded allowlist (false positives, no rotation needed)
• PATCH each alert (1–16) → state=resolved, resolution=false_positive, with a comment citing commit 32c7ee52
• Verify open alert count is 0

Tests

Per the workflow's documentation/operational exception, no TDD phase applies: the fix is
operational alert-dismissal of GitHub-native secret-scanning state (external, not in-repo
testable). The existing local-scanner config guard (tests/test_gitleaks_config.bats)
already covers .gitleaks.toml; recurrence of the committed binary is already blocked by
.gitignore.

Test Command

bats tests/test_gitleaks_config.bats (unchanged; no new tests)

[don-petry]

Dev-Lead: Implementation Complete

Outcome

open_secret_alerts compliance finding resolved: open secret-scanning alerts went
from 16 → 0.

Root Cause (false positives — no real credentials)

All 16 alerts were Google API Key detections inside a single file named gitleaks —
a 21 MB ELF binary (the gitleaks scanner itself) force-committed in
32c7ee52
("chore: apply manual instructions [skip ci-relay]"). The flagged AIzaSy… strings sit
inside gitleaks' own embedded [[rules.allowlists]] — the scanner's built-in example
keys used to suppress its own test fixtures (e.g. the canonical
AIzaSyabcdefghijklmnopqrstuvwxyz1234567). They are not org credentials, so the
"rotate before resolving" gate does not apply.

The binary is already removed from HEAD and recurrence is already prevented — .gitignore
line 402 (/gitleaks, "downloaded fresh in CI, never committed"). The alerts persisted only
because the blob remains in git history.

Action Taken

PATCHed alerts 1–16 → state=resolved, resolution=false_positive, each with a comment
citing commit 32c7ee52 and the gitleaks embedded-allowlist origin. This is the
GitHub-native analogue of the repo's existing .gitleaks.toml allowlist pattern for
false-positive test fixtures.

Verification

open alerts:     0
resolved alerts: 16
.dev-lead/scripts/dev-lead-lint.sh:  [lint] all checks passed
git status: clean (no source changes)

Files Changed

• None. The remediation is operational (GitHub secret-scanning alert state). No source edit
  can clear GitHub-native alerts, and recurrence prevention (/gitleaks in .gitignore) is
  already present.

TDD Exception

Phases 2–5 (test-first) skipped per the workflow's documentation/operational exception: the
fix changes external GitHub alert state, not in-repo behavior, so there is no in-repo
testable unit. The existing tests/test_gitleaks_config.bats (local-scanner config guard)
is unaffected.

Notes / Follow-ups

• These alerts are dismissed, not deleted; they remain auditable and can be reopened.
• Optional org-admin cleanup (history rewrite via git filter-repo to purge the 21 MB blob)
  is out of scope here and would not have changed the alert state — alerts persist until
  dismissed regardless of history rewrites. Open a separate issue if the blob bloat matters.

[don-petry]

Resolved! This check is now passing as of 2026-06-26. Closing automatically.