github-such-software/smirk-backend-core
1
0
Fork 0
mirror of https://github.com/Such-Software/smirk-backend-core.git synced 2026-10-17 07:21:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

security: scanner covers nsec/pepper classes; ignore bare-hex key files; PRIVACY.md

Browse Source 
- tools/secret-scan.sh now also flags nsec1 Nostr secret keys and
  *_PEPPER/*_SALT/*INTEGRITY_SECRET hex assignments, the secret classes
  this backend actually handles (previously only PEM/seed shapes).
- .gitignore: *.hex + admin-key* so an operator running inside the
  checkout cannot commit the raw admin key (create-admin-wallet --out).
- PRIVACY.md pointing to the canonical smirk.cash/privacy, framed for
  self-hosting operators as independent data controllers.
This commit is contained in:
jwinterm
2026-07-19 15:52:07 -04:00
parent a455c60ed0
commit 54fe344d14
3 changed files with 38 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/secret-scan.sh
+6 -2
View File
@@ -17,8 +17,12 @@ else
mapfile -t FILES < <(find . -type f -not -path './.git/*' -not -path './target/*' -printf '%P\n')
fi
# Secret shapes (not names): PEM/OpenSSH/PGP private-key blocks and seed phrases.
PATTERNS='(-----BEGIN ([A-Z ]+ )?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY|BEGIN OPENSSH PRIVATE KEY|\b(mnemonic|seed[_ ]?phrase)\b\s*[:=])'
# Secret shapes (not names), covering the classes this backend actually handles:
# - PEM/OpenSSH/PGP private-key blocks and seed-phrase markers
# - nsec1... Nostr SECRET keys (bech32)
# - a *_PEPPER / *_SALT (or admin key/secret) assigned a 32+ hex-char value, i.e.
# an `openssl rand -hex 32` peppered secret pasted in cleartext
PATTERNS='(-----BEGIN ([A-Z ]+ )?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY|BEGIN OPENSSH PRIVATE KEY|\b(mnemonic|seed[_ ]?phrase)\b\s*[:=]|nsec1[0-9a-z]{20,}|\b[A-Z_]*(PEPPER|SALT|INTEGRITY_SECRET)[A-Z_]*\s*=\s*[0-9a-fA-F]{32,})'
fail=0
for f in "${FILES[@]}"; do