From 1fb549d23e8f77bf6338c060c68213757ab980a2 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 00:50:50 +0700 Subject: [PATCH] security: remove the plaintext OSF token from the research summary (Closes #10581) The OSF OAuth token sat in research/gamma-hypotheses/OSF-upload-summary.md in plain text. The line now says where the token is read from (OSF_TOKEN in the environment). The token stays in history, so it still has to be revoked at osf.io. Same replacement as #6433, without that PR's gate files, which wait for the owner's owner-approved-foreign label. Co-Authored-By: Claude Opus 5.5 --- research/gamma-hypotheses/OSF-upload-summary.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/research/gamma-hypotheses/OSF-upload-summary.md b/research/gamma-hypotheses/OSF-upload-summary.md index 4db6402244..29e715c25b 100644 --- a/research/gamma-hypotheses/OSF-upload-summary.md +++ b/research/gamma-hypotheses/OSF-upload-summary.md @@ -6,7 +6,7 @@ **Node URL:** https://osf.io/tza56 ## OAuth2 Token -Token: `4hZA5K0iVwvJ1hN9fYqaFVJG375xsG94UTfVAKhm7ziWPRbbKccRhM1xl8Xj9nh2iK4RJ3` +Token: not stored in the repository. Read it from the `OSF_TOKEN` environment variable. Status: ✅ Valid (API accepts token) ## API Status