Skip to content

Audit shell scripts for secret leakage in logs #587

Closed
#634
Closed
Audit shell scripts for secret leakage in logs#587
#634
Assignees
unlimitedengineer
Labels
Stellar WaveIssues in the Stellar wave programbugSomething isn't workinggood first issueGood for newcomers

Description

@robertocarlous
robertocarlous
opened on Oct 19, 2026

Problem

The recently removed fix-and-deploy-migrations.sh echoed $DATABASE_URL (which embeds credentials) to stdout. Other operational scripts may do the same.

Scope

Audit scripts/*.sh, scripts/*.ts, and any .github/workflows steps for:

  • Echoing/logging $DATABASE_URL, API keys, or tokens
  • Printing full env dumps
  • Writing secrets into artifacts or GH step summaries

Acceptance criteria

  • No script prints a secret-bearing variable
  • A grep-based CI check (deny-list of echo $DATABASE_URL etc.) is added to prevent regressions

Activity

  1. robertocarlous
    added
    bugSomething isn't working
    good first issueGood for newcomers
    on Oct 19, 2026

  2. rupesh-kumar-sah commented on Oct 19, 2026

    @rupesh-kumar-sah
    rupesh-kumar-sah
    on Oct 19, 2026

    Hi maintainers,

    I reviewed "Audit shell scripts for secret leakage in logs" and have a structured approach ready for implementation:

    I have reviewed the problem description and acceptance criteria for this issue. I have a clear, tested implementation ready with defensive error handling and 100% green CI proof.

    I will deliver a clean, well-tested, and production-ready PR promptly upon assignment. Kindly assign this issue to me.

    Thank you!

  3. drips-wave
    added
    Stellar WaveIssues in the Stellar wave program
    on Oct 20, 2026

  4. Dev-Dare4 commented on Oct 20, 2026

    @Dev-Dare4
    Dev-Dare4
    on Oct 20, 2026 – with Drips Wave

    @Dev-Dare4 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    I’m confident I can fix this issue.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Dev-Dare4 to this issue.

  5. AlphaMaleBaDI commented on Oct 20, 2026

    @AlphaMaleBaDI
    AlphaMaleBaDI
    on Oct 20, 2026 – with Drips Wave

    @AlphaMaleBaDI has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi maintainer,

    I'd be glad to take on issue #587 Audit shell scripts for secret leakage in logs in Neurowealth/Backend. Auditing operational scripts and workflows for secret leakage and introducing an automated grep-based CI check will ensure rigorous credential protection and prevent regressions.

    Technical Implementation Plan
    Analysis & Audit:

    Review all scripts under scripts/.sh, scripts/.ts, and .github/workflows/ steps for any instances of echoing or logging sensitive variables ($DATABASE_URL, API keys, tokens), full environment dumps, or writing secrets into workflow artifacts and step summaries.

    Establish a dedicated feature branch following repository conventions.

    Core Implementation & Prevention:

    Sanitize or remove any secret-bearing echo or print statements across audited operational scripts.

    Implement a robust, automated grep-based deny-list check (e.g., in CI workflows or a pre-commit/pre-push script) targeting unsafe patterns like echo $DATABASE_URL to permanently prevent regressions.

    Testing & Verification:

    Run local script validations, test runs, and the new CI check suite to confirm zero regressions and verify that all security criteria are fully met prior to pull request submission.

    I can have a fully tested, clean PR ready for review within 24 to 48 hours of assignment. Looking forward to contributing!

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @AlphaMaleBaDI to this issue.

  6. unlimitedengineer commented on Oct 20, 2026

    @unlimitedengineer
    unlimitedengineer
    on Oct 20, 2026 – with Drips Wave
    Contributor

    @unlimitedengineer has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    I can audit the operational scripts and GitHub Actions workflows in Neurowealth Backend for secret leakage.

    I’ll check for exposed database URLs, API keys, tokens, environment dumps, and secrets written to artifacts or workflow summaries, then replace unsafe logging with safe alternatives.

    I’ll add a grep based CI check to catch common secret logging patterns and verify the existing scripts comply.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @unlimitedengineer to this issue.

  7. Abidoyesimze
    assigned
    unlimitedengineer
    on Oct 20, 2026

  8. drips-wave commented on Oct 20, 2026

    @drips-wave
    drips-waveBot
    on Oct 20, 2026 – with Drips Wave

    Congratulations, @unlimitedengineer! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

    🧑‍💻 @unlimitedengineer: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

    Warning

    When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

    🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

    🌊 Happy Wave 🌊

  9. Abidoyesimze
    closed this as completedin #634on Oct 20, 2026

  10. grantfox-oss commented on Oct 20, 2026

    @grantfox-oss
    grantfox-ossBot
    on Oct 20, 2026 – with GrantFox OSS

    🎉 This issue has been marked as completed on GrantFox!

    @unlimitedengineer's PR #634 was approved and merged by @Abidoyesimze.

    🏆 @unlimitedengineer: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,646 total points). Track your full progress on GrantFox.

    👏 Great work, @unlimitedengineer! Keep contributing to Neurowealth.

  11. drips-wave commented on Oct 20, 2026

    @drips-wave
    drips-waveBot
    on Oct 20, 2026 – with Drips Wave

    This issue has been completed by @unlimitedengineer as part of the Stellar Wave Program's 10th Wave 🥳

    😎 @unlimitedengineer: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

    🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

  12. dunnie99
    added a commit that references this issue on Oct 20, 2026

    fix: script secret leakage, TOTP throttling, impersonation audit, att…

    e768ef5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programbugSomething isn't workinggood first issueGood for newcomers

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions