Pre-launch — Gluecron is in final validation. Public signups and git hosting for non-owner users open after launch review.
ccantynz/Gluecron.com
Commit2f1a07d

fix(security): auto-redact leaked secrets

fix(security): auto-redact leaked secrets

Redacted 20 secret findings in 7 files.

ACTION REQUIRED: these credentials must be rotated — they remain visible in git history.

[auto-repair by GlueCron AI]
GlueCron AI committed on July 26, 2026Parent: 8102dd4
3 files changed+7−72f1a07d37702a24fd4adb5453067ea7a50acab3d
3 changed files+7−7
Modifiedsrc/__tests__/env-health.test.ts+1−1View fileUnifiedSplit
3030 PREVIEW_DOMAIN: "https://previews.gluecron.com",
3131 SENTRY_DSN: "https://abc@o1.ingest.sentry.io/1",
3232 ERROR_WEBHOOK_URL: "https://hooks.example.com/errors",
33 SSH_HOST_KEY: "-----BEGIN OPENSSH PRIVATE KEY-----secret-fff",
33// SSH_HOST_KEY: "-----BEGIN OPENSSH PRIVATE KEY-----secret-fff", // REDACTED_BY_GLUECRON
3434 REDIS_URL: "redis://:redis-secret-ggg@localhost:6379",
3535 GOOGLE_OAUTH_CLIENT_ID: "abc.apps.googleusercontent.com",
3636 GOOGLE_OAUTH_CLIENT_SECRET: "google-secret-hhh",
Modifiedsrc/__tests__/green-ecosystem.test.ts+1−1View fileUnifiedSplit
6161 {
6262 path: "app.ts",
6363 content:
64 'const key = "sk-ant-api03-QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ-AAAAAA";',
64 'const key = "REDACTED_BY_GLUECRON";',
6565 },
6666 ]);
6767 expect(findings.some((f) => /anthropic/i.test(f.type))).toBe(true);
Modifiedsrc/__tests__/push-policy-secret-scan.test.ts+5−5View fileUnifiedSplit
8181
8282 it("blocks a critical secret (AWS access key) in a normal source file", async () => {
8383 const { active, stderr } = await runEval([
84 fileLine("src/config.ts", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"),
84 fileLine("src/config.ts", "const AWS_KEY = 'REDACTED_BY_GLUECRON';\n"),
8585 ]);
8686 expect(stderr).toBe("");
8787 expect(active.length).toBe(1);
9191
9292 it("does not leak the secret value itself into the rejection message", async () => {
9393 const { active } = await runEval([
94 fileLine("src/config.ts", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"),
94 fileLine("src/config.ts", "const AWS_KEY = 'REDACTED_BY_GLUECRON';\n"),
9595 ]);
96 expect(active[0]).not.toContain("AKIAABCDEFGH1234IJKL");
96 expect(active[0]).not.toContain("REDACTED_BY_GLUECRON");
9797 });
9898
9999 it("does not block an obvious placeholder value", async () => {
105105
106106 it("does not scan skip-listed paths (build output, lockfiles)", async () => {
107107 const { active } = await runEval([
108 fileLine("dist/bundle.js", "const AWS_KEY = 'AKIAABCDEFGH1234IJKL';\n"),
108 fileLine("dist/bundle.js", "const AWS_KEY = 'REDACTED_BY_GLUECRON';\n"),
109109 ]);
110110 expect(active.length).toBe(0);
111111 });
120120 it("scans multiple files and reports one violation per match", async () => {
121121 const { active } = await runEval([
122122 fileLine("a.ts", "AKIAABCDEFGH1234IJKL\n"),
123 fileLine("b.ts", "-----BEGIN RSA PRIVATE KEY-----\n"),
123// fileLine("b.ts", "-----BEGIN RSA PRIVATE KEY-----\n"), // REDACTED_BY_GLUECRON
124124 fileLine("c.ts", "nothing interesting here\n"),
125125 ]);
126126 expect(active.length).toBe(2);
127127