Release 1/11: gitleaks scan over full history (blocks going public) #42

New Issue

2026-08-08T18:43:10-04:00

jared commented

2026-08-08 18:43:10 -04:00

Blocks everything else. Going public is irreversible — code that has been public gets forked and archived within hours.

Run a proper secret scan over the full history before the repo is exposed.

gitleaks detect --source . --log-opts="--all" --redact -v

What is already known

A coarse grep over all 140 commits found no share tokens, credentials or bearer strings, and the default corpus URL in R/config.R was still the REPLACE_WITH_SHARE_TOKEN placeholder (it is now the public Hugging Face URL). So this is expected to be clean — but a grep is not a scanner, and this is the one step that cannot be undone.

Also check

Issue history on this repo, for anything client-identifying.
.gitea/workflows/ci.yml — it references secrets.USCOGDATA_TOKEN. Variable names becoming public is fine; confirm no value was ever inlined.

Done when

gitleaks reports no findings over --all
Issue history skimmed

**Blocks everything else. Going public is irreversible — code that has been public gets forked and archived within hours.** Run a proper secret scan over the full history before the repo is exposed. ```sh gitleaks detect --source . --log-opts="--all" --redact -v ``` ## What is already known A coarse `grep` over all 140 commits found no share tokens, credentials or bearer strings, and the default corpus URL in `R/config.R` was still the `REPLACE_WITH_SHARE_TOKEN` placeholder (it is now the public Hugging Face URL). So this is expected to be clean — but a grep is not a scanner, and this is the one step that cannot be undone. ## Also check - Issue history on this repo, for anything client-identifying. - `.gitea/workflows/ci.yml` — it references `secrets.USCOGDATA_TOKEN`. Variable *names* becoming public is fine; confirm no value was ever inlined. ## Done when - [ ] `gitleaks` reports no findings over `--all` - [ ] Issue history skimmed

jared referenced this issue

2026-08-08 18:43:10 -04:00

Release 2/11: make the Gitea repo public, disable its issues #43

jared commented

2026-08-08 19:01:11 -04:00