Skip to content

A live key was sitting in an unignored log; .bak files were unignored too #56

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ThinkOffApp merged 1 commit into from
Aug 3, 2026
Merged

A live key was sitting in an unignored log; .bak files were unignored too #56

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,20 @@ config/*.bak*
gemini-config.json
gemini-config.json.bak*
scripts/__pycache__/

# Backup copies of edited files. The `*.bak.*` rule above requires a dot
# AFTER "bak", so it matches "foo.bak.1" and silently does NOT match a plain
# "foo.bak" outside config/. Found 2026-08-03: 14 such files sitting untracked
# in a clone of this PUBLIC repo, one `git add -A` from being published. The
# cp-before-edit habit is a good one; it just needs the ignore rules to match
# the names it actually produces.
*.bak
*.bak_*
*-bak
*-bak.*

# Run logs. `*.log` above does not cover them, because start-all writes .out.
# A log is a plausible place for a key to land: the file that prompted this
# was logs/start-all.out on the Mini, which contained a live xfb_ agent key.
logs/
*.out

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restrict the global .out ignore to run logs

When a contributor adds a legitimate .out artifact, such as an expected-output test fixture, this root-level wildcard silently excludes it from every directory. The preceding logs/ rule already covers the cited logs/start-all.out credential leak, and a repo-wide search found no other run-log location that requires ignoring all .out files, so this should be scoped to the log directory or the specific generated file.

Useful? React with 👍 / 👎.

Loading