security: redact the revoked GitLab PAT from QUICKSTART.adoc - #535
Merged
Conversation
The token was committed 2026-02-22 ("Auto-commit: Sync changes") and has sat on
public `main` for five months, 40 occurrences in one file. The owner revoked it
2026-07-27, so this removes the dead credential from the working tree.
Replaced with `glpat-<REVOKED-TOKEN-REDACTED>` rather than deleting the
surrounding documentation, which is otherwise legitimate.
Verified:
live-token occurrences in file 40 -> 0
placeholders written 40
whole-tree grep for a live PAT no matches
AsciiDoc mirror scan findings 72 -> 0
files changed 1
WHY HISTORY IS NOT REWRITTEN HERE — deliberate, not an oversight.
The owner authorised a history rewrite. Measuring it first showed a cost that
outweighs the benefit now that the token is dead:
* The estate carries 2,021 pinned references to 32 distinct standards commit
SHAs (`uses: hyperpolymath/standards/.github/workflows/*.yml@<sha>`).
Verified that those SHAs are real commits in this history — e.g.
c65436e (181 wrappers) and d135b05 (83 wrappers).
* A rewrite orphans every one of them. Unreachable commits are GC-able, and
once collected, every pinned caller fails to resolve its `uses:` — the
estate-wide `startup_failure` class this repo has been fixing all week.
* The token is already revoked, so a rewrite buys hygiene, not security.
The dead credential remaining in history is the cheaper problem. If a rewrite
is still wanted, it should be sequenced with a pin-refresh sweep across all
2,021 references, not done standalone. A full pre-rewrite backup bundle of all
refs was taken before this was evaluated.
Refs the secret-scanner work in #528 — this is the leak that scanner could not
see until the AsciiDoc blind spot was closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the dead credential from the working tree. Owner revoked the token 2026-07-27.
What was there
Committed 2026-02-22 ("Auto-commit: Sync changes"), 40 occurrences in one file, on public
mainfor five months.Replaced with
glpat-<REVOKED-TOKEN-REDACTED>rather than deleting the surrounding documentation, which is otherwise legitimate.⚠ History is deliberately NOT rewritten — please read
A rewrite was authorised. I measured it before running it, and the cost now outweighs the benefit:
standardscommit SHAs (uses: hyperpolymath/standards/.github/workflows/*.yml@<sha>).c65436ee(181 wrappers) andd135b05(83 wrappers).uses:— precisely the estate-widestartup_failureclass this repo has spent the week eliminating.A dead credential sitting in history is the cheaper problem than 2,021 broken workflow references.
If you still want the rewrite, it should be sequenced with a pin-refresh sweep across all 2,021 references rather than done standalone. A full backup bundle of all refs was taken before this was evaluated and is retained.
Note
standardsalready carries zero Nix artefacts (noflake.nix/flake.lock/default.nix/shell.nix) — it is already Guix-only, withguix.scmplus 8 manifests. Nothing to retire here.Refs #528 — this is the leak that scanner could not see until the AsciiDoc blind spot was closed.
🤖 Generated with Claude Code