Skip to content

docs: add before-push security checklist to CONTRIBUTING.md (Closes #50) #92

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
laurentketterle-hub wants to merge 1 commit into from
Closed

docs: add before-push security checklist to CONTRIBUTING.md (Closes #50) #92

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,9 +55,28 @@ npm test # Same as demo

- Never commit `.env` or generated wallet secrets.
- Use placeholders only in `.env.example`.
- Before every push, run `git diff --staged` and verify no keys are present.
- If a secret is exposed, rotate it immediately.

### Before Push Security Checklist

Run these commands before every push to avoid accidental secret leaks:

```bash
# 1. Verify you're on the right branch
git status

# 2. Review staged changes for secrets
git diff --staged

# 3. Scan for common credential patterns
git diff --staged | grep -E '(api_key|API_KEY|secret|SECRET|token|TOKEN|password|PASSWORD|private.key|PRIVATE.KEY)'

# 4. If no secrets found, proceed with push
git push
```
Comment on lines +71 to +76

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not treat this grep as a complete secret scan.

The command only searches for generic words such as secret, token, and password. It misses the policy-defined S... private keys, sk-ant-... API keys, .env files, and generated wallet secrets when their contents do not contain those words. A clean result therefore does not justify the next git push command.

Scan staged paths and content with policy-specific patterns, or use a dedicated secret scanner. Require manual review of git diff --staged before pushing, and preserve .env.example as the documented placeholder exception.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CONTRIBUTING.md` around lines 71 - 76, Update the credential-checking
instructions in the staged push workflow to state that the generic grep is
insufficient. Require scanning staged paths and content with policy-specific
patterns or a dedicated secret scanner, manually reviewing git diff --staged
before git push, and preserving .env.example as the documented placeholder
exception.


> **Tip**: If any of the grep patterns match, remove the secret immediately and rotate it if it was already committed. See [SECURITY.md](SECURITY.md) for the full security policy and reporting process.

### Formatting and linting

This project uses ESLint and Prettier to keep code and docs consistent. Before opening a PR, run:
Expand Down
Loading