fizzlepoof/homelab-showcase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden public showcase privacy controls
Some checks failed
public-safety / privacy-and-secret-scan (push) Has been cancelled
Details

Browse Source
This commit is contained in:
fizzlepoof
2026-09-08 22:04:38 +00:00
parent cc35523888
commit 3e0975af21
9 changed files with 97 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/security.md
View File

@@ -31,9 +31,9 @@ Removing a value from the latest commit does not remove it from Git history.
## Repository controls
The public repository uses two checks:
The public repository uses layered checks:
- `scripts/check-public-safety.py` rejects infrastructure identifiers, private paths, key-like files, and common secret patterns.
- `scripts/check-public-safety.py` rejects infrastructure identifiers, private paths, key-like files, binary files, raw-export filenames, non-approved URL hosts, and common secret patterns. Its source is executed and syntax-checked rather than matched against its own detector literals.
- Gitleaks scans complete Git history in CI.
The scanner is deliberately conservative. Placeholder examples should use unmistakable values such as:
@@ -64,4 +64,4 @@ https://service.example.net
## Reporting
Do not open a public issue containing a suspected secret. Revoke it first and use a private contact channel for disclosure.
Do not open a public issue containing a suspected secret. Revoke it first, then use [GitHub private vulnerability reporting](https://github.com/fizzlepoof/homelab-showcase/security/advisories/new). The repository owner may also be contacted through an already established private channel.