Complete the source review and secret scan of the public repository #42

Activity

1. iamnbutler

   added a parent issue on Oct 4, 2026

   • [Meta] Prepare wider desktop distribution #7
2. iamnbutler

   changed the title [-]Review source and scan for secrets before making the repository public[/-] [+]Complete the source review and secret scan of the public repository[/+] on Oct 6, 2026
3. iamnbutler commented on Oct 13, 2026

   

   iamnbutler

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Secret scan: clean

   Run on October 13 against 39dc8d0, covering every branch and all 95 refs/pull/*/head (343 reachable commits).

   • GitHub secret scanning: on, with push protection. 0 open and 0 resolved alerts.
   • gitleaks 8.30.1 (gitleaks git --log-opts=--all): 265 commits with changes, 3.4 MB scanned, no leaks.
   • Pattern grep of the full git log --all -p: no matches. Searched for:
     • private-key blocks
     • Anthropic, OpenAI, GitHub, AWS, Slack and Google key formats
     • values assigned to ACE_SECRET, R2_*, ACE_SPARKLE_PRIVATE_KEY and ACE_CERTIFICATE_PASSWORD

   Source review: nothing to remove

   What was covered:

   • Tracked tree: all 354 tracked files, searched for *.ts.net hosts, personal paths, private and CGNAT IPs, every URL, references to private githubnext/* repos, Slack/Teams/Microsoft domains, 1Password, emails, phone numbers, account and team IDs, and markers like "internal", "NDA" and "do not share".
   • Configs and licenses: the wrangler configs, the release workflow and the bundled license files were read.
   • History: all 341 commit authors (only iamnbutler@github.com), commit subjects, full diffs, deleted files, and blobs over 300 KB.

   Findings:

   • 1Password path (docs/updates.md:166): names the vault and item "1Password → Dev → Ace desktop releases". Low risk; optionally reword.
   • Developer ID (docs/updates.md:168): signing uses Nate's personal Developer ID. Not a leak, since the name appears in every signed app. Decide whether launch should use an org identity.
   • r2.dev URL and luau-updates bucket (docs/updates.md:106-107): public by design. They go away with the custom domain in Move desktop downloads to a custom domain #40.
   • Account, Team and notary IDs: stored only in GitHub vars/secrets; no literal values in the tree or history.
   • Agentation 3.1.2 is PolyForm Shield 1.0.0: not OSI open source, and it has a non-compete clause. It's bundled in the desktop web app (apps/app/src/annotations.tsx, feat(app): add keyboard-controlled Agentation feedback #209) and now listed in the notices (feat(desktop): bundle third-party notices and link them from About Ace #221). Needs OSPO or legal confirmation before a public stable release, or restrict it to dev builds.
   • githubnext/desktop-tools: public and MIT, so bun install works for outside users.
   • Deleted TODO.md: names the private githubnext/ace. Harmless; no history rewrite.

   Not covered

   Issue and PR bodies, Actions logs and release notes on GitHub. They're public too and could use a quick pass.

   Remaining before closing

   • Agentation license decision
   • Optional: reword the 1Password and Developer ID lines
4. iamnbutler commented on Oct 13, 2026

   

   iamnbutler

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Agentation and the internal 1Password and personal signing references are short-term development tooling. They're tracked for removal before Universe under Dev tool cleanup in #218. The scan and review above are complete; this issue closes when those items land.
5. iamnbutler commented on Oct 15, 2026

   

   iamnbutler

   on Oct 15, 2026

   ContributorAuthor

   More actions

   Closing: the scan and review above are complete, and both remaining items landed.

   • Agentation: removed from shipped builds in chore(app): remove Agentation from shipped builds #238 (bdb83e3): the dependency, apps/app/src/annotations.tsx, and the desktop shortcut are gone. Canary 0.0.46's web assets contain no Agentation code.
   • 1Password and personal signing lines: chore: remove internal operations details from release docs #237 (35be9c7) reworded docs/updates.md, which now says "the team's password manager" and names only a Developer ID identity.

   Small leftover: apps/app/public/agentation-license.txt is still tracked and ships in the bundle (Resources/app/web/), though the code it licensed is gone. It's a one-file delete and isn't tracked anywhere yet.

   Moving release signing from the personal Developer ID to Gatewatcher is a release gate in #217, not a review finding. Both GitHub environments still use the same ACE_CODESIGN_IDENTITY.
6. iamnbutler

   closed this as completedon Oct 15, 2026