chore: ignore loose password/credential scratch files at any depth - #434
Merged
Conversation
A 44-byte `pw5523.txt` sat untracked at the repo root from 2026-08-07 to
2026-08-15 — created the same day one `git add -A` published 176 files to this
PUBLIC repo. Nothing in the existing credential block matched it, because every
pattern there targets key material by extension (*.p8, *.p12, *.key, AuthKey_*)
and this is a .txt.
Deliberately NOT root-anchored, for the reason already recorded further down in
this file: the 2026-07-31 internal-docs block was written root-anchored "so
docs/ content is unaffected", and that is precisely what let 49 files under
docs/ through on 08-07.
Verified to FIRE rather than merely to pass:
- catches the real pw5523.txt (`git check-ignore` -> .gitignore:44)
- catches synthetic files at depth: docs/pw1.txt, "CLI Pulse Bar/passwords.txt",
backend/my_password.txt, helper/aws-credentials.json, deep/a/b/secrets2.txt
- shadows NOTHING already tracked (`git ls-files` match set is empty), so no
tracked file silently becomes un-re-addable later
The file itself is left alone on disk — this only stops it being swept into a
commit. Moving it to the out-of-repo secrets directory is the owner's call.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gap
A 44-byte
pw5523.txthas been sitting untracked at the repo root since 2026-08-07 — the same day onegit add -Apublished 176 files to this public repo. It shows up as??in everygit status, so any futureadd -Aor a carelessadd .takes it.Nothing in the existing credential block matched it. Every pattern there targets key material by extension:
pw5523.txtis a.txt. It sailed straight through.Not root-anchored, on purpose
This file already records why, a few blocks down: the 2026-07-31 internal-docs patterns were written root-anchored "so
docs/content is unaffected", and that is exactly what let 49 files underdocs/through on 08-07. Repeating that mistake in the credential block would be worse.Verified to fire, not merely to pass
pw5523.txt.gitignore:44docs/pw1.txtCLI Pulse Bar/passwords.txtbackend/my_password.txthelper/aws-credentials.jsondeep/a/b/secrets2.txtgit ls-filesmatch set is emptyThat last row matters as much as the others: an ignore rule that covers a tracked file leaves it tracked but silently un-re-addable after any move, which is a trap that surfaces months later.
pw5523.txtitself is untouched on disk — this only stops it being swept into a commit. Relocating it to the out-of-repo secrets directory is the owner's call.🤖 Generated with Claude Code