[Senate] Security Manager: periodic git history scan for leaked secrets and credentials
Task ID: ce02eceb-b31e-46d5-9de5-f4abdbcce3f8
Priority: 95
Layer: Senate (Governance & Security)
Status: In Progress
Goal
Perform a comprehensive security audit of the SciDEX repository to detect any leaked secrets, credentials, or sensitive information in git history, configuration files, and codebase. Document findings and recommend remediation steps without disrupting system access or operations.
Acceptance Criteria
☑ Scan entire git history for common secret patterns (API keys, tokens, passwords, AWS credentials)
☑ Check all configuration files (.env, .conf, .json, *.md) for hardcoded secrets
☑ Verify AWS Secrets Manager is properly configured for scidex-s3-readonly and scidex-s3-readwrite
☑ Audit Python scripts (api.py, backup.sh, agent.py, etc.) for hardcoded credentials
☑ Document findings in SECURITY.md with severity levels and remediation steps
☑ Assess exposure: determine if secrets were pushed to GitHub public repo
☑ Provide rotation recommendations for any leaked credentials
☑ CRITICAL: Do NOT lock anyone out, change SSH keys, or modify access controls
Approach
Git History Scan
- Use git log to search for secret patterns across all branches
- Check deleted files and old commits for legacy secrets
File System Scan
- Scan .env files and config directories
- Check spec files and documentation for embedded credentials
- Review Orchestra task descriptions for sensitive data
AWS Secrets Manager Audit
- Verify proper secret storage configuration
- Check if application code correctly retrieves secrets from Secrets Manager
Code Audit
- Review Python scripts for hardcoded credentials
- Check database connection strings
- Verify API keys are environment-based
Documentation
- Create comprehensive SECURITY.md report
- Include severity levels (CRITICAL, HIGH, MEDIUM, LOW)
- Provide specific remediation steps
- Document best practices for future secret management
Work Log
2026-04-02 — Slot 12 (Start)
- Task acquired from Orchestra
- Created spec file
- Starting git history scan and security audit
2026-04-02 — Slot 12 (Complete)
- Git History Scan: Clean - no secrets found in any commit across entire history
- Configuration Files: .env properly secured (600 permissions, in .gitignore)
- Code Audit: All secrets loaded via os.environ.get() - zero hardcoded credentials
- CRITICAL FINDING: GitHub PAT embedded in git remote URL (HIGH severity)
- Token NOT in git history (verified clean)
- Token visible to shell users via
git remote -v - Requires rotation with human approval
- AWS Secrets Manager: Not fully configured, falls back to instance role (works but suboptimal)
- Nginx: Missing security headers (low priority)
- Created comprehensive SECURITY.md with:
- Severity-rated findings (1 CRITICAL, 2 MEDIUM)
- Detailed remediation steps
- Action items with timelines
- Best practices documentation
- Audit methodology and verification
- Result: DONE - One critical finding requires human approval for token rotation. No access disruptions. All other security practices verified as sound.
Already Resolved — 2026-04-24 18:00:00Z
SECURITY.md and this spec exist on main (committed 2026-04-02, merged via Squash to 698ed86b2). Re-verification performed 2026-04-24 confirms all acceptance criteria still hold:
Evidence:
git log --all --diff-filter=A -p | grep -iE "(api_key|secret|password|token|AWS_SECRET|AKIAQ)" — zero real credential leaks; only scientific text matches (e.g. "secretion", "@mention tokens")- Credential pattern scan (
AKIA, sk-ant-, ghp_, gho_) across all .py/.sh/.md/.json/.yaml files — 0 matches
- SECURITY.md (338 lines) present on main at
698ed86b2 with full audit, severity ratings, and action items
- Git remote URL still contains embedded PAT — flagged as CRITICAL in SECURITY.md, awaiting human approval for rotation (per task constraint: do NOT rotate without explicit approval)
- All other security practices remain sound:
.env at 600 permissions, gitignored; all secrets via os.environ.get()
Status: Work is complete. PAT rotation remains open and requires human action.