Test: Scan compose secrets by data shape

2026-08-26 22:31:22 -04:00
parent a19c6dc3ef
commit 37fd5e890e
7 changed files with 185 additions and 27 deletions
@@ -0,0 +1,5 @@
+POSTGRES_PASSWORD=CHANGE_ME
+API_TOKEN=
+ALLOW_EMPTY_PASSWORD=yes
+FEATURE_SECRET_ENABLED=false
+PRIVATE_KEY_PATH=/run/secrets/private_key
@@ -0,0 +1,5 @@
+This prose is not a Compose assignment: password: example.
+It also says secret key without defining one.
+The server README sentence that triggered the audit is reproduced here:
+under `server/` carries anything that looks like a secret: this repository is
+public, and the gitignore is a seatbelt, not the brakes.
@@ -0,0 +1,8 @@
+services:
+  database:
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
+      API_TOKEN: ${API_TOKEN:-CHANGE_ME}
+      ALLOW_EMPTY_PASSWORD: yes
+      DATABASE_NAME: application
@@ -0,0 +1 @@
+API_TOKEN=fixture-should-be-rejected
@@ -0,0 +1,4 @@
+services:
+  database:
+    environment:
+      POSTGRES_PASSWORD: fixture-should-be-rejected