`data/code-leaks.json`

61 lines
{
  "source": "fleet static-debug sweep — 306 git projects, 2026-05-31",
  "leaks": [
    {
      "severity": "critical",
      "service": "Shopify Admin API token",
      "last4": "75b9",
      "project": "mfr-review-viewer",
      "file_abs": "/Users/macstudio3/Projects/mfr-review-viewer/server.js",
      "line": 197,
      "scope": "LIVE store designer-laboratory-sandbox · MUTATE+DELETE",
      "regen_url": "https://admin.shopify.com/store/designer-laboratory-sandbox/settings/apps/development",
      "envified": false,
      "note": "UNTOUCHED — SECURITY-HOLD.md gates this repo. Rotate the Shopify token FIRST, then delete SECURITY-HOLD.md to un-suspend + let secret-strip env-ify it."
    },
    {
      "severity": "high",
      "service": "ElevenLabs API key",
      "last4": "1770",
      "project": "dear-bubbe-nextjs",
      "file_abs": "/Users/macstudio3/Projects/dear-bubbe-nextjs/ecosystem.config.js",
      "line": 9,
      "scope": "TTS account · billable",
      "regen_url": "https://elevenlabs.io/app/settings/api-keys",
      "envified": true,
      "note": "Code env-ified ✓ 2026-05-31 (ecosystem.config.js + 2 docs + voice-monitor.sh, 4 copies removed). STILL ROTATE — key remains in git history; same repo carried the n0de malware (now clean), treat as compromised."
    },
    {
      "severity": "medium",
      "service": "George Basic Auth (admin:DWSecure…24!)",
      "last4": "024!",
      "project": "cncp-domains",
      "file_abs": "/Users/macstudio3/Projects/cncp-domains/scripts/expiring-soon.sh",
      "line": 15,
      "scope": "info-inbox basic-auth",
      "regen_url": "",
      "envified": true,
      "note": "Code env-ified ✓ 2026-05-31 (now requires GEORGE_AUTH from env, fails loud if unset). Part of the global DWSecure2024! rotation."
    },
    {
      "severity": "medium",
      "service": "compliance-agent admin fallback",
      "last4": "024!",
      "project": "compliance-agent",
      "file_abs": "/Users/macstudio3/Projects/compliance-agent/src/server.js",
      "line": 20,
      "scope": "admin login default",
      "regen_url": "",
      "envified": true,
      "note": "Code env-ified ✓ 2026-05-31 (literal default removed; random per-boot secret if COMPLIANCE_ADMIN_PASS unset — admin login disabled-by-default, no bypass). Part of the global DWSecure2024! rotation."
    }
  ],
  "malware": {
    "service": "/var/tmp/.font/n0de launcher",
    "project": "dear-bubbe-nextjs",
    "status": "removed Mac2 (committed) · Kamatera VERIFIED CLEAN 2026-05-31: /var/tmp/.font gone, no miner proc, [kswapd0]/[kdevtmpfs] confirmed genuine kernel threads (ppid=2, no exe), no rogue uid-0",
    "kamatera_verified": "2026-05-31",
    "kamatera_check": "ssh root@45.61.58.125 'ls -la /var/tmp/.font/; ps aux | grep -i n0de | grep -v grep'"
  }
}