From 8efb612c7168c36a69e8e611a6e82c393207657e Mon Sep 17 00:00:00 2001 From: Raaid Rushdy Date: Wed, 19 Aug 2026 13:48:39 +1000 Subject: [PATCH 1/3] sec: add gitleaks CI job scanning full commit history --- .github/workflows/ci.gitleaks.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/workflows/ci.gitleaks.yml diff --git a/.github/workflows/ci.gitleaks.yml b/.github/workflows/ci.gitleaks.yml new file mode 100644 index 00000000..82cec88b --- /dev/null +++ b/.github/workflows/ci.gitleaks.yml @@ -0,0 +1,23 @@ +name: Gitleaks Secret Scan (Full History) + +on: + push: + branches: [main, staging] + pull_request: + branches: [main, staging] + schedule: + - cron: '0 3 * * 1' + +permissions: + contents: read + +jobs: + gitleaks: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file From 6b5300c7a52cb98bb8f24800819b3a3befe99942 Mon Sep 17 00:00:00 2001 From: Raaid Rushdy Date: Wed, 19 Aug 2026 13:57:42 +1000 Subject: [PATCH 2/3] sec: switch gitleaks CI to CLI install, avoiding org license requirement --- .github/workflows/ci.gitleaks.yml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.gitleaks.yml b/.github/workflows/ci.gitleaks.yml index 82cec88b..28a7199c 100644 --- a/.github/workflows/ci.gitleaks.yml +++ b/.github/workflows/ci.gitleaks.yml @@ -14,10 +14,21 @@ permissions: jobs: gitleaks: runs-on: ubuntu-latest + env: + GITLEAKS_VERSION: 8.30.1 steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file + + - name: Install gitleaks (verified checksum) + run: | + set -euo pipefail + curl -sSLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" + curl -sSLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt" + sha256sum -c <(grep "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" "gitleaks_${GITLEAKS_VERSION}_checksums.txt") + tar -xzf "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" gitleaks + sudo mv gitleaks /usr/local/bin/gitleaks + + - name: Run gitleaks + run: gitleaks detect --source . --log-opts="--all" --redact --exit-code 1 \ No newline at end of file From ce33d52496ae02e653ea9474b69bcfb99f824698 Mon Sep 17 00:00:00 2001 From: Raaid Rushdy Date: Wed, 19 Aug 2026 14:07:26 +1000 Subject: [PATCH 3/3] sec: add gitleaks baseline so CI only fails on new findings --- .github/workflows/ci.gitleaks.yml | 2 +- .gitleaks-baseline.json | 695 ++++++++++++++++++++++++++++++ 2 files changed, 696 insertions(+), 1 deletion(-) create mode 100644 .gitleaks-baseline.json diff --git a/.github/workflows/ci.gitleaks.yml b/.github/workflows/ci.gitleaks.yml index 28a7199c..f5849112 100644 --- a/.github/workflows/ci.gitleaks.yml +++ b/.github/workflows/ci.gitleaks.yml @@ -31,4 +31,4 @@ jobs: sudo mv gitleaks /usr/local/bin/gitleaks - name: Run gitleaks - run: gitleaks detect --source . --log-opts="--all" --redact --exit-code 1 \ No newline at end of file + run: gitleaks detect --source . --log-opts="--all" --redact --baseline-path .gitleaks-baseline.json --exit-code 1 \ No newline at end of file diff --git a/.gitleaks-baseline.json b/.gitleaks-baseline.json new file mode 100644 index 00000000..74a30a51 --- /dev/null +++ b/.gitleaks-baseline.json @@ -0,0 +1,695 @@ +[ + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 11, + "EndLine": 11, + "StartColumn": 20, + "EndColumn": 79, + "Match": "ENCRYPTION_KEY=REDACTED`", + "Secret": "REDACTED", + "File": "docs/DevSecOps/baseline-audit.md", + "SymlinkFile": "", + "Commit": "ceef78441114074e32ec4d6be2f1832b6cf0105d", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/ceef78441114074e32ec4d6be2f1832b6cf0105d/docs/DevSecOps/baseline-audit.md?plain=1#L11", + "Entropy": 4.726144, + "Author": "Raaid Rushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-08-16T13:45:26Z", + "Message": "docs: clarify GCP key escalation status as pending", + "Tags": [], + "Fingerprint": "ceef78441114074e32ec4d6be2f1832b6cf0105d:docs/DevSecOps/baseline-audit.md:generic-api-key:11" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 11, + "EndLine": 11, + "StartColumn": 22, + "EndColumn": 81, + "Match": "ENCRYPTION_KEY=REDACTED`", + "Secret": "REDACTED", + "File": "docs/DevSecOps/baseline-audit.md", + "SymlinkFile": "", + "Commit": "e85a14b71b778810c3489b29a3ab14243a27ef98", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/e85a14b71b778810c3489b29a3ab14243a27ef98/docs/DevSecOps/baseline-audit.md?plain=1#L11", + "Entropy": 4.726144, + "Author": "Raaid Rushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-08-16T13:25:56Z", + "Message": "docs: add baseline security audit for Workstream 4", + "Tags": [], + "Fingerprint": "e85a14b71b778810c3489b29a3ab14243a27ef98:docs/DevSecOps/baseline-audit.md:generic-api-key:11" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 31, + "EndLine": 31, + "StartColumn": 2, + "EndColumn": 77, + "Match": "_DEFAULT_DEV_ENCRYPTION_KEY = \"REDACTED\"", + "Secret": "REDACTED", + "File": "backend-api/app/db/seed_dev.py", + "SymlinkFile": "", + "Commit": "0b628b163395cf71ae3bdf328d7f6e78345a5f19", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/0b628b163395cf71ae3bdf328d7f6e78345a5f19/backend-api/app/db/seed_dev.py#L31", + "Entropy": 4.726144, + "Author": "Peibing Gu", + "Email": "peibing@iMac.modem", + "Date": "2026-07-17T01:05:40Z", + "Message": "Fixed issues in ci and linter", + "Tags": [], + "Fingerprint": "0b628b163395cf71ae3bdf328d7f6e78345a5f19:backend-api/app/db/seed_dev.py:generic-api-key:31" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 116, + "EndLine": 116, + "StartColumn": 12, + "EndColumn": 71, + "Match": "ENCRYPTION_KEY: REDACTED", + "Secret": "REDACTED", + "File": ".github/workflows/ci.backend-api.yml", + "SymlinkFile": "", + "Commit": "6cd96fc98c8246fc9339b101a1b547f7ad327358", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/6cd96fc98c8246fc9339b101a1b547f7ad327358/.github/workflows/ci.backend-api.yml#L116", + "Entropy": 4.726144, + "Author": "dig", + "Email": "digbyjame@gmail.com", + "Date": "2026-04-24T04:09:14Z", + "Message": "add build + unit test steps in backend-api workflow", + "Tags": [], + "Fingerprint": "6cd96fc98c8246fc9339b101a1b547f7ad327358:.github/workflows/ci.backend-api.yml:generic-api-key:116" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 8, + "EndLine": 8, + "StartColumn": 25, + "EndColumn": 87, + "Match": "ENCRYPTION_KEY\", \"REDACTED\"", + "Secret": "REDACTED", + "File": "backend-api/tests/conftest.py", + "SymlinkFile": "", + "Commit": "3310e8591f88dbdb74c6fd02cb90b9b9cae9d793", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/3310e8591f88dbdb74c6fd02cb90b9b9cae9d793/backend-api/tests/conftest.py#L8", + "Entropy": 4.726144, + "Author": "dig", + "Email": "digbyjame@gmail.com", + "Date": "2026-04-24T03:55:53Z", + "Message": "add backend-api unit tests", + "Tags": [], + "Fingerprint": "3310e8591f88dbdb74c6fd02cb90b9b9cae9d793:backend-api/tests/conftest.py:generic-api-key:8" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 213, + "EndLine": 213, + "StartColumn": 17, + "EndColumn": 76, + "Match": "ENCRYPTION_KEY=REDACTED ", + "Secret": "REDACTED", + "File": ".github/workflows/preview-deploy.yml", + "SymlinkFile": "", + "Commit": "f5f13553c3dd95af510479ceba2639ce777336f8", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/f5f13553c3dd95af510479ceba2639ce777336f8/.github/workflows/preview-deploy.yml#L213", + "Entropy": 4.726144, + "Author": "dig", + "Email": "digbyjame@gmail.com", + "Date": "2026-04-23T04:45:49Z", + "Message": "feat: replace paid preview services with github native stack (ghcr and cf tunnels)", + "Tags": [], + "Fingerprint": "f5f13553c3dd95af510479ceba2639ce777336f8:.github/workflows/preview-deploy.yml:generic-api-key:213" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 259, + "EndLine": 259, + "StartColumn": 17, + "EndColumn": 76, + "Match": "ENCRYPTION_KEY=REDACTED ", + "Secret": "REDACTED", + "File": ".github/workflows/preview-deploy.yml", + "SymlinkFile": "", + "Commit": "f5f13553c3dd95af510479ceba2639ce777336f8", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/f5f13553c3dd95af510479ceba2639ce777336f8/.github/workflows/preview-deploy.yml#L259", + "Entropy": 4.726144, + "Author": "dig", + "Email": "digbyjame@gmail.com", + "Date": "2026-04-23T04:45:49Z", + "Message": "feat: replace paid preview services with github native stack (ghcr and cf tunnels)", + "Tags": [], + "Fingerprint": "f5f13553c3dd95af510479ceba2639ce777336f8:.github/workflows/preview-deploy.yml:generic-api-key:259" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 130, + "EndLine": 130, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L130", + "Entropy": 3.7439427, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:130" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 139, + "EndLine": 139, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L139", + "Entropy": 3.5848296, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:139" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 148, + "EndLine": 148, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L148", + "Entropy": 3.528213, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:148" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 157, + "EndLine": 157, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L157", + "Entropy": 3.8153114, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:157" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 166, + "EndLine": 166, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L166", + "Entropy": 3.7439427, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:166" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 175, + "EndLine": 175, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L175", + "Entropy": 3.8464394, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:175" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 184, + "EndLine": 184, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L184", + "Entropy": 3.7439427, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:184" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 193, + "EndLine": 193, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L193", + "Entropy": 3.8159573, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:193" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 202, + "EndLine": 202, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L202", + "Entropy": 3.8464394, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:202" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 209, + "EndLine": 209, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L209", + "Entropy": 3.768454, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:209" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 218, + "EndLine": 218, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L218", + "Entropy": 3.7526555, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:218" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 227, + "EndLine": 227, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L227", + "Entropy": 3.858695, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:227" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 236, + "EndLine": 236, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L236", + "Entropy": 3.7439427, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:236" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 245, + "EndLine": 245, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L245", + "Entropy": 3.7634606, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:245" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 254, + "EndLine": 254, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L254", + "Entropy": 3.8061984, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:254" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 261, + "EndLine": 261, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L261", + "Entropy": 3.7740245, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:261" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 268, + "EndLine": 268, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L268", + "Entropy": 3.7653115, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:268" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 275, + "EndLine": 275, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L275", + "Entropy": 3.6061983, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:275" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 284, + "EndLine": 284, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L284", + "Entropy": 3.6240244, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:284" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 293, + "EndLine": 293, + "StartColumn": 11, + "EndColumn": 68, + "Match": "hashed_secret\": \"REDACTED\"", + "Secret": "REDACTED", + "File": ".secrets.baseline", + "SymlinkFile": "", + "Commit": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/8bb12a3e14f80ee484059a6c45af3a3e9b868dbe/.secrets.baseline#L293", + "Entropy": 3.5750706, + "Author": "raaidrushdy", + "Email": "raaidrushdy@gmail.com", + "Date": "2026-04-20T04:10:56Z", + "Message": "feat(appsec): add detect-secrets baseline for existing codebase", + "Tags": [], + "Fingerprint": "8bb12a3e14f80ee484059a6c45af3a3e9b868dbe:.secrets.baseline:generic-api-key:293" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 20, + "EndLine": 20, + "StartColumn": 2, + "EndColumn": 60, + "Match": "ENCRYPTION_KEY=REDACTED", + "Secret": "REDACTED", + "File": "backend-api/.env.example", + "SymlinkFile": "", + "Commit": "40cab10a463cd7126496867c2c84ece231d9b974", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/40cab10a463cd7126496867c2c84ece231d9b974/backend-api/.env.example#L20", + "Entropy": 4.726144, + "Author": "David Hartley", + "Email": "s216386962@deakin.edu.au", + "Date": "2025-12-11T10:41:17Z", + "Message": "Update .env.example for when the backend is running locally", + "Tags": [], + "Fingerprint": "40cab10a463cd7126496867c2c84ece231d9b974:backend-api/.env.example:generic-api-key:20" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 93, + "EndLine": 93, + "StartColumn": 10, + "EndColumn": 68, + "Match": "ENCRYPTION_KEY=REDACTED", + "Secret": "REDACTED", + "File": "docker-compose.yml", + "SymlinkFile": "", + "Commit": "2e1b28f39d904381fb0082d06e61618c189da7ea", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/2e1b28f39d904381fb0082d06e61618c189da7ea/docker-compose.yml#L93", + "Entropy": 4.726144, + "Author": "David Hartley", + "Email": "s216386962@deakin.edu.au", + "Date": "2025-12-11T10:40:07Z", + "Message": "Add OPA container, backend env vars and worker container", + "Tags": [], + "Fingerprint": "2e1b28f39d904381fb0082d06e61618c189da7ea:docker-compose.yml:generic-api-key:93" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 127, + "EndLine": 127, + "StartColumn": 10, + "EndColumn": 68, + "Match": "ENCRYPTION_KEY=REDACTED", + "Secret": "REDACTED", + "File": "docker-compose.yml", + "SymlinkFile": "", + "Commit": "2e1b28f39d904381fb0082d06e61618c189da7ea", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/2e1b28f39d904381fb0082d06e61618c189da7ea/docker-compose.yml#L127", + "Entropy": 4.726144, + "Author": "David Hartley", + "Email": "s216386962@deakin.edu.au", + "Date": "2025-12-11T10:40:07Z", + "Message": "Add OPA container, backend env vars and worker container", + "Tags": [], + "Fingerprint": "2e1b28f39d904381fb0082d06e61618c189da7ea:docker-compose.yml:generic-api-key:127" + }, + { + "RuleID": "generic-api-key", + "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.", + "StartLine": 4, + "EndLine": 4, + "StartColumn": 2, + "EndColumn": 88, + "Match": "VIRUSTOTAL_API_KEY = \"REDACTED\"", + "Secret": "REDACTED", + "File": "database/tprm_scanner/checkers/threat_intel_checker.py", + "SymlinkFile": "", + "Commit": "4d8e074a653a7cc7b749d11e6eb773e1123155d6", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/4d8e074a653a7cc7b749d11e6eb773e1123155d6/database/tprm_scanner/checkers/threat_intel_checker.py#L4", + "Entropy": 3.9064462, + "Author": "hatetech15", + "Email": "64640292+hatetech15@users.noreply.github.com", + "Date": "2025-09-19T12:51:37Z", + "Message": "Added tprm_scanner module inside database", + "Tags": [], + "Fingerprint": "4d8e074a653a7cc7b749d11e6eb773e1123155d6:database/tprm_scanner/checkers/threat_intel_checker.py:generic-api-key:4" + }, + { + "RuleID": "rapidapi-access-token", + "Description": "Uncovered a RapidAPI Access Token, which could lead to unauthorized access to various APIs and data services.", + "StartLine": 16, + "EndLine": 16, + "StartColumn": 15, + "EndColumn": 83, + "Match": "x-rapidapi-key\": \"REDACTED\"", + "Secret": "REDACTED", + "File": "database/tprm_scanner/checkers/reputation_checker.py", + "SymlinkFile": "", + "Commit": "4d8e074a653a7cc7b749d11e6eb773e1123155d6", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/4d8e074a653a7cc7b749d11e6eb773e1123155d6/database/tprm_scanner/checkers/reputation_checker.py#L16", + "Entropy": 4.161077, + "Author": "hatetech15", + "Email": "64640292+hatetech15@users.noreply.github.com", + "Date": "2025-09-19T12:51:37Z", + "Message": "Added tprm_scanner module inside database", + "Tags": [], + "Fingerprint": "4d8e074a653a7cc7b749d11e6eb773e1123155d6:database/tprm_scanner/checkers/reputation_checker.py:rapidapi-access-token:16" + }, + { + "RuleID": "private-key", + "Description": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.", + "StartLine": 5, + "EndLine": 5, + "StartColumn": 20, + "EndColumn": 1749, + "Match": "REDACTED", + "Secret": "REDACTED", + "File": "engine/test-sa-key.json", + "SymlinkFile": "", + "Commit": "4fe952c8849943e7b090e716c4639e6a84188496", + "Link": "https://github.com/Hardhat-Enterprises/AutoAudit/blob/4fe952c8849943e7b090e716c4639e6a84188496/engine/test-sa-key.json#L5", + "Entropy": 6.02326, + "Author": "Aditya Hindocha", + "Email": "s223159756@deakin.edu.au", + "Date": "2025-09-03T09:32:02Z", + "Message": "added code in collecter to extract compute networks config", + "Tags": [], + "Fingerprint": "4fe952c8849943e7b090e716c4639e6a84188496:engine/test-sa-key.json:private-key:5" + } +]