Rotate the leaked Gitea PAT + establish secrets management #11

New Issue

2026-07-16T10:37:37+02:00

mivanchenko commented

2026-07-16 10:37:37 +02:00

A write:repository Gitea PAT was exposed in a working session/transcript and must be revoked (git.mivanchenko.de → Settings → Applications). Rotate anything else that shared that exposure.

Broader: real deployed secrets live scattered across per-service .env files + the Caddyfile on the homelab. Introduce proper secrets management (e.g. Vaultwarden — already planned — or sops/age-encrypted env in the repo) so secrets have a single source of truth, are rotatable, and never sit in plaintext where they can leak.

Acceptance: leaked PAT revoked; a documented secrets store + rotation runbook; repo confirmed free of plaintext secrets (.gitignore already covers .env, .secrets/).

A `write:repository` Gitea PAT was exposed in a working session/transcript and must be **revoked** (git.mivanchenko.de → Settings → Applications). Rotate anything else that shared that exposure. Broader: real deployed secrets live scattered across per-service `.env` files + the Caddyfile on the homelab. Introduce proper secrets management (e.g. Vaultwarden — already planned — or `sops`/age-encrypted env in the repo) so secrets have a single source of truth, are rotatable, and never sit in plaintext where they can leak. **Acceptance:** leaked PAT revoked; a documented secrets store + rotation runbook; repo confirmed free of plaintext secrets (`.gitignore` already covers `.env`, `.secrets/`).

mivanchenko added the ops security labels 2026-07-16 10:37:37 +02:00

mivanchenko added the needs-triage label 2026-07-23 10:31:44 +02:00

mivanchenko added the enhancement label 2026-07-23 10:48:03 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: BPPP/smb-online#11