chore: delete a test script containing a committed API key - #398
Merged
Merged
Conversation
test-scripts/test-api-upsert-behavior.sh hardcoded a live Hookdeck project API key on line 11 and used it to authenticate three calls to api.hookdeck.com. It was committed on 2025-10-29 and has been public since, across main, release/v3.0.0, 24 of 29 remote branches and 44 tags whose source tarballs carry it. The key has been revoked, so the string is inert. Deleting rather than parameterising: nothing references this script -- no workflow, no package.json entry, no Makefile target -- and what it probes (whether source and destination are required when updating a connection) is covered properly by the upsert cases in test/acceptance/connection_test.go. Keeping it would mean keeping a file whose remaining purpose is to hold a credential. History is not rewritten. Once the key is revoked the committed string has no value, and purging it would mean rewriting main plus 44 tags and force-pushing a public repository -- a bigger and riskier change than the exposure now warrants. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BnrKWZQASV7bFJ4oGWwmo9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deletes
test-scripts/test-api-upsert-behavior.sh, which hardcoded a live Hookdeck project API key on line 11 and used it toBearer-authenticate three calls toapi.hookdeck.com.Exposure
03adebd, 2025-10-29 — public for 320 daystm_htnSCvufI7RK("First project used in CI testing"), orgorg_bB7LoMBOeQH0main,release/v3.0.0,feat/api-2026-09-01, 24 of 29 remote branches, 44 of 102 tagsIt was a project-scoped key: full read/write over that one project — connections, sources, destinations, transformations, and event/request payload history. The key has been revoked (
GET /projectsnow returns 401, confirmed), so the committed string is inert.Mitigating: the project is in the
Automated Testingorganization, not Hookdeck production, withmax_events_per_second: 5.Why delete rather than parameterise
package.jsonscript, no Makefile target. CI only invokestest-npm-build.shandtest-homebrew-build.shfrom that directory, neither of which touches the API.sourceanddestinationare required when updating a connection — is already covered properly by the upsert cases intest/acceptance/connection_test.go.History is deliberately not rewritten
Once revoked, the committed string has no value. Purging it would mean rewriting
mainplus 44 tags and force-pushing a public repository — a larger and riskier change than the remaining exposure justifies. Worth treating as a separate, deliberate decision if it's wanted.Not affected
The leaked key matched none of the five credentials in the local
test/acceptance/.env(compared by SHA-256; values never printed), so it is a sixth, separate credential rather than a copy of a CI secret.Two things that remain worth confirming, and are not resolved by this PR:
HOOKDECK_CLI_TESTING_API_KEYin GitHub Actions was last updated 2025-06-14 — the same date projecttm_htnSCvufI7RKwas created. The leaked key reaches that same project, and CI runs against it. So the two are related to the same project even though the values differ locally..envcan drift from the Actions secret of the same name. The decisive check is empirical: with the key now revoked, re-run the acceptance workflow. If it passes, CI's secret is genuinely a different credential.Follow-up worth considering
Enable secret scanning / push protection on the repo, and gitignore ad-hoc probe scripts under
test-scripts/.🤖 Generated with Claude Code
https://claude.ai/code/session_01BnrKWZQASV7bFJ4oGWwmo9