auto-surface live tokens also hardcoded in code to top of rotation list (Shopify 75b9)

c5b2a5810b48adf5434b2b6aee557661e2e609a6 · 2026-05-31 17:16:29 -0700 · steve

Files touched

M public/index.html

Diff

commit c5b2a5810b48adf5434b2b6aee557661e2e609a6
Author: steve <steve@designerwallcoverings.com>
Date:   Sun May 31 17:16:29 2026 -0700

    auto-surface live tokens also hardcoded in code to top of rotation list (Shopify 75b9)
---
 public/index.html | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/public/index.html b/public/index.html
index d6357c1..d0da165 100644
--- a/public/index.html
+++ b/public/index.html
@@ -156,15 +156,24 @@ function render(d){
       <div class="app"><span>${a[0]}</span>${(a[1]&&a[1]!=='root')?pill('ok',a[1]):pill('bad',a[1]||'?')}</div>`).join('')}</div>
     <div class="note">internet-adjacent apps de-rooted first. ${total-done} still root, contained by UFW.</div>`;
 
-  // secrets
-  const s=d.secrets||[];
+  // secrets — cross-reference last-4 against the fleet code-leak sweep so any
+  // LIVE token also found hardcoded in source auto-surfaces at the top.
+  const leakBy = {};
+  ((d.codeLeaks&&d.codeLeaks.leaks)||[]).forEach(l=>{ if(l.last4) leakBy[l.last4]=l; });
+  const s=(d.secrets||[]).map(x=>{ const hit=leakBy[x.last4]; return {...x,
+    inCode: hit?{project:hit.project,scope:hit.scope||'',sev:hit.severity}:null}; });
+  // sort: hardcoded-live first, then stale, then fresh
+  s.sort((a,b)=> (b.inCode?2:0)+(b.stale?1:0) - ((a.inCode?2:0)+(a.stale?1:0)) );
   const stale=s.filter(x=>x.stale).length;
+  const incode=s.filter(x=>x.inCode).length;
   document.getElementById('secrets').innerHTML = `
     <div style="margin-bottom:10px">${stale>0?pill('bad',stale+' of '+s.length+' need rotation'):pill('ok','all rotated')}
+      ${incode>0?pill('bad',incode+' also hardcoded in code'):''}
       <span class="note" style="margin-left:8px">console-only regen → paste new value, auto fan-out. digests only below.</span></div>
     <table><tr><td>Key</td><td>last-4</td><td>rotated</td><td>status</td><td></td></tr>
-    ${s.map(x=>`<tr>
-      <td>${x.label}<div class="mut mono" style="font-weight:400;font-size:11px">${x.key}</div></td>
+    ${s.map(x=>`<tr${x.inCode?' style="background:rgba(248,114,114,.06)"':''}>
+      <td>${x.inCode?'⚠ ':''}${x.label}<div class="mut mono" style="font-weight:400;font-size:11px">${x.key}</div>
+        ${x.inCode?`<div class="pill bad" style="margin-top:4px;font-size:10.5px">LIVE token hardcoded · ${x.inCode.project}${x.inCode.scope?' · '+x.inCode.scope:''}</div>`:''}</td>
       <td class="mono">…${x.last4}</td>
       <td class="mono mut">${x.rotated}</td>
       <td>${x.stale?pill('bad','rotate'):pill('ok','fresh')}</td>

← 8a8144e add fleet hardcoded-cred + malware card; Kamatera malware ve · back to Security Dashboard · dashboard: mark 3 leaks env-ified (code closed; still rotate cf95d58 →