Skip to content

chore(security): ignore key material so an identity file cannot be committed #2171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaylfc merged 4 commits into from
Jul 27, 2026
+16 −0
Merged

chore(security): ignore key material so an identity file cannot be committed #2171

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ae0c6a4
chore(security): ignore key material so an identity file cannot be co…
jaylfc Jul 27, 2026
4a0dc78
chore: correct the date in the ignore comment
jaylfc Jul 27, 2026
97bd98e
chore: drop the duplicate data/hub/ rule and correct the rationale
jaylfc Jul 27, 2026
6eeedf7
chore: narrow *_private.* so it cannot swallow source files
jaylfc Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,3 +152,19 @@ data/.seeded-agent-tokens.json
data/secrets.db*
data/*.key
data/*.token

# Key material and secrets. Added 2026-07-27 after data/hub/identity.json was
# committed to PR #2043 with signing_private and encryption_private in
# PLAINTEXT. data/hub/ is already covered above; these patterns close the REST
# of the surface, which was open: an identity.json or a *.key written anywhere
# outside data/hub/ had nothing stopping it. Pattern-based on purpose, since a
# per-file allowlist cannot catch a file that does not exist yet.
# Verified against every tracked file: none become ignored.
*.key
*_private.pem
*_private.key
*_private.json
*_private_key*
identity.json

@kilo-code-bot kilo-code-bot Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: identity.json is redundant with the existing data/hub/ rule (line 96) and overly broad — it ignores identity.json repo-wide. If a legitimate identity.json is needed outside data/hub/, it will be silently ignored.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

*.p8
*credentials.json
Comment thread
coderabbitai[bot] marked this conversation as resolved.

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Ignore credential temp files as well.

The atomic writer creates data/mesh_credentials.json.tmp; *credentials.json does not match that filename. If the process stops before os.replace, the temporary file can retain plaintext tokens and remain committable. Add a suffix-aware, data-scoped rule such as data/**/*credentials.json*.

The same temporary-file behavior is defined in tinyagentos/taosnet/mesh_credentials.py.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.gitignore at line 168, Update the credential ignore rules in .gitignore to
cover temporary credential filenames, including data/mesh_credentials.json.tmp,
by adding a data-scoped suffix-aware pattern such as data/**/*credentials.json*.
Ensure the rule protects both final and temporary files produced by the
mesh_credentials.py atomic writer.

@kilo-code-bot kilo-code-bot Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SUGGESTION: *credentials.json is very broad and would ignore any file ending in credentials.json, including legitimate test fixtures or sample configurations like test_credentials.json. Consider narrowing to *_credentials.json if the intent is only to catch files with the _credentials naming convention.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

Loading