From 8518a73685769121261cf59153338a666a0c6de0 Mon Sep 17 00:00:00 2001 From: mptyl Date: Sun, 12 Jul 2026 11:34:32 +0200 Subject: [PATCH] fix(security): scrub raw deployment secret values --- backend/src/pi/provider-credentials.ts | 5 +++++ backend/test/provider-credentials.test.ts | 3 +++ 2 files changed, 8 insertions(+) diff --git a/backend/src/pi/provider-credentials.ts b/backend/src/pi/provider-credentials.ts index 91e7f607..525f82ae 100644 --- a/backend/src/pi/provider-credentials.ts +++ b/backend/src/pi/provider-credentials.ts @@ -110,8 +110,13 @@ export function buildPiChildEnv(opts: { delete env.THT_DWH_API_KEY; delete env.THT_VEC_API_KEY; delete env.THT_VEC_WRITE_API_KEY; + delete env.THT_MODEL_API_KEY; delete env.THT_SSL_CA; delete env.THT_CA; + delete env.THT_VECTOR_BOOTSTRAP_PASSWORD; + delete env.THT_VECTOR_MIGRATOR_PASSWORD; + delete env.THT_VECTOR_READER_PASSWORD; + delete env.THT_VECTOR_WRITER_PASSWORD; delete env.THT_MODEL_API_KEY_FILE; delete env.THT_DWH_API_KEY_SECRET_FILE; delete env.THT_VEC_API_KEY_SECRET_FILE; diff --git a/backend/test/provider-credentials.test.ts b/backend/test/provider-credentials.test.ts index 3210e944..e8352845 100644 --- a/backend/test/provider-credentials.test.ts +++ b/backend/test/provider-credentials.test.ts @@ -123,6 +123,7 @@ test("bundle value is injected without exposing bundle metadata to Pi", () => { THT_DWH_API_KEY: "dwh-secret", THT_VEC_API_KEY: "vec-reader-secret", THT_VEC_WRITE_API_KEY: "vec-writer-secret", THT_SSL_CA: "/run/secrets/ca.pem", THT_CA: "/run/secrets/ca.pem", THT_DWH_API_KEY_SECRET_FILE: "/run/secrets/dwh", + THT_MODEL_API_KEY: "model-secret", THT_VECTOR_READER_PASSWORD: "reader-secret", THT_VECTOR_READER_PASSWORD_FILE: "/tmp/thothii-secrets/reader", THT_VECTOR_WRITER_PASSWORD_FILE: "/tmp/thothii-secrets/writer", THT_DWH_API_KEY_FILE: "/run/secrets/dwh", THT_VEC_API_KEY_FILE: "/run/secrets/vec", @@ -135,8 +136,10 @@ test("bundle value is injected without exposing bundle metadata to Pi", () => { expect(env).not.toHaveProperty("THT_DWH_API_KEY"); expect(env).not.toHaveProperty("THT_VEC_API_KEY"); expect(env).not.toHaveProperty("THT_VEC_WRITE_API_KEY"); + expect(env).not.toHaveProperty("THT_MODEL_API_KEY"); expect(env).not.toHaveProperty("THT_SSL_CA"); expect(env).not.toHaveProperty("THT_CA"); + expect(env).not.toHaveProperty("THT_VECTOR_READER_PASSWORD"); expect(env).not.toHaveProperty("THT_DWH_API_KEY_SECRET_FILE"); expect(env).not.toHaveProperty("THT_VECTOR_READER_PASSWORD_FILE"); expect(env).not.toHaveProperty("THT_VECTOR_WRITER_PASSWORD_FILE");