Rotate the plaintext credentials found in git history #398

New issue

Open

opened 2026-09-23 13:31:27 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-09-23 13:31:27 +02:00

Owner

A full scan of git history turned up ten cleartext credentials, seven of them still live in HEAD, plus eleven committed password hashes.

Every one is readable by anyone with a clone, so deleting the line does not fix it — the blob stays reachable in every clone and on the remote forever. Rotation at the source is the only remediation.

The findings, with path, line and introducing commit, are in docs/security/git-history-secret-audit.md. Values are deliberately not reproduced there.

Priority order:

Both WiFi PSKs (Cloonar-Multimedia, Cloonar-Smart) — the credentials to the networks every other host sits on. Live in HEAD.
Electrolux/AEG cloud account — a real third-party account credential, cleartext for five months. History only, still needs rotating.
Unidentified 32-byte secret in buchhaltung.md:2 — needs identifying before it can be rotated. Live in HEAD.
ESPHome AP passwords and MQTT passwords — including an MQTT user whose password is the literal string password. Live in HEAD.
Committed password hashes — offline-crackable; move behind hashedPasswordFile + SOPS, which is the pattern used everywhere else in this repo.

Clean results worth recording: no provider API tokens have ever been committed, no private key material, and no unencrypted SOPS file — the ADR-0025 rename was a pure git mv with byte-identical blobs.

A full scan of git history turned up ten cleartext credentials, seven of them still live in HEAD, plus eleven committed password hashes. Every one is readable by anyone with a clone, so **deleting the line does not fix it** — the blob stays reachable in every clone and on the remote forever. Rotation at the source is the only remediation. The findings, with path, line and introducing commit, are in `docs/security/git-history-secret-audit.md`. Values are deliberately not reproduced there. Priority order: 1. **Both WiFi PSKs** (`Cloonar-Multimedia`, `Cloonar-Smart`) — the credentials to the networks every other host sits on. Live in HEAD. 2. **Electrolux/AEG cloud account** — a real third-party account credential, cleartext for five months. History only, still needs rotating. 3. **Unidentified 32-byte secret** in `buchhaltung.md:2` — needs identifying before it can be rotated. Live in HEAD. 4. **ESPHome AP passwords and MQTT passwords** — including an MQTT user whose password is the literal string `password`. Live in HEAD. 5. **Committed password hashes** — offline-crackable; move behind `hashedPasswordFile` + SOPS, which is the pattern used everywhere else in this repo. Clean results worth recording: no provider API tokens have ever been committed, no private key material, and no unencrypted SOPS file — the ADR-0025 rename was a pure `git mv` with byte-identical blobs.

dominik.polakovics referenced this issue

2026-09-23 13:31:55 +02:00

Document the git-history plaintext-secret audit #399