From 8027b2a61b6da34249c0d6436b782d3bf9309427 Mon Sep 17 00:00:00 2001 From: jaylfc Date: Mon, 27 Jul 2026 22:54:37 +0000 Subject: [PATCH] chore(security): ignore creds bundles, the shape the first pass missed PR #2171 closed the identity/key-material shapes but a plain creds.json still slipped through: *credentials.json does not match creds.json. @taOS-website-dev found this running the same audit on its own repo, which is the argument for having every repo run the check rather than trusting one pass. Verified on origin/dev before committing: creds.json, my_creds.json and data/creds.json were all NOT ignored, and 0 of 3100 tracked files become ignored by the new pattern. --- .gitignore | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.gitignore b/.gitignore index c17699b73..1f6dcc81f 100644 --- a/.gitignore +++ b/.gitignore @@ -168,3 +168,11 @@ data/*.token identity.json *.p8 *credentials.json + +# Credential bundles. Added 2026-07-27: @taOS-website-dev ran the same audit +# on its repo and found shapes my first pass (PR #2171) missed. Verified on +# origin/dev: creds.json, my_creds.json and data/creds.json were all NOT +# ignored, while *credentials.json already was. Matching the *creds* stem +# closes the shorter spelling, which is the one people actually type. +# Verified against every tracked file on origin/dev: 0 become ignored. +*creds*.json