chore(security): ignore creds bundles, the shape #2171 missed

[jaylfc]

Follow-up to #2171, prompted by @taOS-website-dev running the same audit on its own repo and finding shapes my first pass missed. That is the useful part of this PR: one repo's audit found a gap in another's, which is why the check is worth running everywhere rather than trusting a single pass.

The gap. *credentials.json does not match creds.json. Verified against merged origin/dev:

NOT IGNORED creds.json
NOT IGNORED my_creds.json
NOT IGNORED data/creds.json
IGNORED     x_credentials.json
IGNORED     foo.p8
IGNORED     identity.json

*creds*.json closes the shorter spelling, which is the one people actually type.

Safety check, done the way I got caught not doing before: tested against git ls-tree -r origin/dev rather than my local branch. 0 of 3100 tracked files become ignored.

Summary by CodeRabbit

• Chores
  • Updated project file exclusions to prevent credential-related JSON files from being included accidentally.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 882d1001-f3b7-45a9-8177-8c97640bff7a

📥 Commits

Reviewing files that changed from the base of the PR and between 077105e and 8027b2a.

📒 Files selected for processing (1)

• .gitignore

---

📝 Walkthrough

Walkthrough

Expanded .gitignore with a *creds*.json pattern and accompanying verification comments for credential bundle files.

Changes

Credential ignore coverage

Layer / File(s)	Summary
Credential bundle ignore rule .gitignore	Adds *creds*.json and audit comments alongside existing credential patterns.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• jaylfc/taOS#2171: Both changes expand .gitignore patterns for credential and key-material files.

Suggested reviewers: hognek

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the change: it adds a missing ignore pattern for creds bundles.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/secret-ignores-creds

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Ignore creds JSON bundles missed by prior security audit

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Add a broader .gitignore pattern to catch common creds.json credential bundles.
• Document why the pattern was added and how it was safety-checked on origin/dev.

High-Level Assessment

The following are alternative approaches to this PR:

1. Add automated secret scanning (gitleaks / GitHub secret scanning)

• ➕ Catches committed secrets even if filenames don’t match ignore patterns
• ➕ Scales better than enumerating filename shapes over time
• ➖ Requires CI/configuration and ongoing maintenance of rules/exceptions
• ➖ May introduce false positives that need triage

2. Add local hooks (pre-commit + detect-secrets / git-secrets)

• ➕ Prevents accidental commits before they land in the repo
• ➕ Works even when developers forget to update ignore patterns
• ➖ Relies on developer adoption and consistent tooling setup
• ➖ Still may miss secrets added via non-hooked flows (e.g., direct pushes)

Recommendation: Keep this .gitignore change: it closes a concrete, demonstrated gap with minimal risk (validated that 0 tracked files become ignored). Longer-term, consider complementing ignores with automated secret scanning (CI and/or pre-commit) because filename-based patterns can’t cover all leakage paths.

Files changed (1) +8 / -0

Other (1) +8 / -0

.gitignoreIgnore *creds*.json credential bundle filenames and document rationale +8/-0

Ignore creds.json credential bundle filenames and document rationale

• Adds a new ignore pattern '*creds*.json' to catch common credential bundle filenames like 'creds.json' and 'my_creds.json' that were not covered by '*credentials.json'. Includes detailed comments documenting the audit motivation and verification that no tracked files on origin/dev become ignored.

.gitignore

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• .gitignore

---

_{Reviewed by step-3.7-flash · Input: 36K · Output: 4K · Cached: 117.9K}