From 39d645097b29924aa60977c81ce3da0d885ffca8 Mon Sep 17 00:00:00 2001 From: "will.anderson" Date: Fri, 21 Aug 2026 18:59:08 -0500 Subject: [PATCH] docs(audit): log credential-in-origin-url finding and rotation status --- FORK-AUDIT.md | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/FORK-AUDIT.md b/FORK-AUDIT.md index aacda23b29..3d4d889193 100644 --- a/FORK-AUDIT.md +++ b/FORK-AUDIT.md @@ -277,3 +277,46 @@ primary evidence source for them. wide mechanical churn best done once, deliberately, before any publish. 4. Remaining third-party auth plugins (GitLab, Poe, DigitalOcean, xai, Cerebras) — keep or prune per actual provider usage. + +--- + +## Part 8: Credential embedded in the fork's origin URL (HIGH) + +**Found:** While restructuring the workspace layout (fork promoted to +canonical `neuron/`, Elisp codebase archived), the fork's `origin` remote was +found configured as +`https://oauth2:@git.neuralplatform.ai/neuron-technologies/neuron.git` +— a bearer credential baked directly into `.git/config`. + +**Why this is a total non.** This repo's own doctrine (Part 6) condemns +exactly this pattern: long-lived identity credentials carried silently by +routine machinery. A token in a remote URL is worse than a token in an env +var — it is: + +- **Stored in plaintext** inside `.git/config`, outside any secret store. +- **Echoed by accident**: `git remote -v`, `git push` errors, CI logs, + shared screenshots, and any script that prints remotes all leak it. + This one in fact leaked into a working-session transcript on 2026-08-21. +- **Indistinguishable from intent**: anyone auditing the repo config cannot + tell a deliberate credential sink from a convenience paste. +- **Copy-propagating**: clones, worktrees, and mirror commands inherit the + URL verbatim, seeding new machines with the same live credential. + +The irony is recorded plainly: we stripped upstream's token-laundering auth +plugins (Part 1.5) while sitting on a credential pasted into our own remote. +Same sin, smaller blast radius, zero excuse. + +**Status: FIXED.** +- Origin rewritten to SSH form + (`git@git.neuralplatform.ai:neuron-technologies/neuron.git`) — 2026-08-21. +- `upstream` remote deleted outright per the upstream-cut decision; no + tracking relationship to `anomalyco/opencode` remains. + +**Residual action required:** the exposed token must be treated as +compromised-at-rest and **revoked/rotated** on git.neuralplatform.ai, since +it persisted in config and was echoed to a transcript. Until rotation is +confirmed, this item stays open. + +**Containment:** local config only; never committed, never pushed. But it +did reach a session log, which is precisely the leak channel this section +warns about — logged here so the gate failure is on record.