Skip to content

Security and secrets handling

Purpose

Collect useful operational evidence without exposing credentials or sensitive configuration.

Rules

  • Never commit or print passwords, tokens, private keys, raw environment files, OAuth secrets, ACME state, database credentials, unredacted exports, or backup contents.
  • Document secret names, restricted path, required owner/mode, rotation owner, and a safe presence/permission check.
  • Keep raw exports and filled answer files outside the repository.
  • Prefer selected fields and metadata over unrestricted env, inspect, config, database queries, or recursive archive listings.
  • Treat generated runner registration and Forgejo authorized_keys data as sensitive operational state even when it contains public keys.

Safe evidence procedure

  1. State the exact question.
  2. Select only non-secret fields.
  3. Run the narrowest read-only command.
  4. Redact public IPs, personal identifiers, fingerprints, and paths when they do not help the handbook.
  5. Record the command shape, date, result, and confidence.
  6. Delete temporary sensitive output through the approved process.

Redaction

Use configuration redaction, then manually inspect the result. Automated redaction is a filter, not proof that an export is safe.

rg -n -i 'password|passwd|secret|token|private.?key|api.?key|client.?secret' \
  --glob '!site/**' --glob '!*.svg' .

Expected: only documentation, examples, redaction rules, and placeholders. Investigate any value-bearing match.

Incident response

If a secret enters Git:

  1. Stop sharing or publishing the affected content.
  2. Rotate/revoke the secret first.
  3. Preserve incident evidence securely.
  4. Remove the value from current source.
  5. Decide whether history rewriting is required; obtain explicit approval before rewriting shared history.
  6. Review logs and dependent systems.

Official references