spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Security][Go-live] Move all secrets out of source control & establish secret injection #404

New Issue
Open
opened 2026-07-05 20:23:42 +00:00 by spikerj · 3 comments
spikerj commented 2026-07-05 20:23:42 +00:00
Owner
Copy Link
Copy Source

Context: learn.spikersoft.com is pre-beta (no real users/data), so this is a go-live prerequisite, not an active breach. Today these are dev/test credentials — but the pattern must never reach production, and any secret reused in prod is already burned.

Problem: The entire secret set is committed to git, including the AES master key that would encrypt user PII. There is no production override, so committed values carry straight to prod.

Evidence:

  • SpikerSoft.Api/appsettings.json:451 — Encryption:MasterKey (wraps every data-encryption key)
  • :268 / :272 — Keycloak client secrets
  • :295 Stripe · :446 Twilio · :413 SMTP · :307 MSSQL sa · :212/217 InfluxDB · :402 Seq
  • Same secrets repeated across ~41 tracked files + SpikerSoft.AI.MCPServer/appsettings.*.json:4

Fix:

  • Move all secrets to Docker/Swarm secrets or a vault; inject at runtime
  • Rotate any credential that will be reused in production
  • Purge from git history (BFG / git-filter-repo)
  • Add pre-commit + CI secret scanning

Acceptance criteria:

  • No secrets in any committed appsettings*.json (placeholders only)
  • Secrets sourced from Swarm secrets/vault at runtime
  • CI fails on a newly committed secret
  • Git history scrubbed of the master key & live credentials

Effort: M–L · Prerequisite for the production deployment model (INF-2, this batch).

**Context:** learn.spikersoft.com is pre-beta (no real users/data), so this is a **go-live prerequisite, not an active breach**. Today these are dev/test credentials — but the pattern must never reach production, and any secret reused in prod is already burned. **Problem:** The entire secret set is committed to git, including the AES master key that would encrypt user PII. There is no production override, so committed values carry straight to prod. **Evidence:** - `SpikerSoft.Api/appsettings.json:451` — `Encryption:MasterKey` (wraps every data-encryption key) - `:268` / `:272` — Keycloak client secrets - `:295` Stripe · `:446` Twilio · `:413` SMTP · `:307` MSSQL sa · `:212/217` InfluxDB · `:402` Seq - Same secrets repeated across ~41 tracked files + `SpikerSoft.AI.MCPServer/appsettings.*.json:4` **Fix:** - Move all secrets to Docker/Swarm secrets or a vault; inject at runtime - Rotate any credential that will be reused in production - Purge from git history (BFG / git-filter-repo) - Add pre-commit + CI secret scanning **Acceptance criteria:** - No secrets in any committed `appsettings*.json` (placeholders only) - Secrets sourced from Swarm secrets/vault at runtime - CI fails on a newly committed secret - Git history scrubbed of the master key & live credentials **Effort:** M–L · Prerequisite for the production deployment model (INF-2, this batch).
spikerj added the agentic label 2026-07-05 20:23:42 +00:00
spikerj commented 2026-07-05 20:25:08 +00:00
Author
Owner
Copy Link
Copy Source

Prerequisite for the production deployment model INF-2 #414.

Prerequisite for the production deployment model **INF-2 #414**.
spikerj commented 2026-07-06 22:40:39 +00:00
Author
Owner
Copy Link
Copy Source

Verified finding — live secrets hardcoded in SpikerSoft.Api/appsettings.json (surfaced while adding webhook-signature validation)

Committed production credentials currently in source (listing keys only, not values):

  • Twilio:AuthToken — Twilio account auth token (also the key that signs webhook HMACs, so it's security-critical).
  • Encryption:MasterKey — a base64 AES master key.
  • InfluxDB:Token / InfluxDashboard:Token — InfluxDB API token (same value in both blocks).
  • Keycloak:backend-api:secret and Keycloak:health-check:secret — Keycloak client secrets.

Anyone with repo read access has these. Because .NET config layering lets environment variables override appsettings.json, the migration is low-risk per key: inject each as Section__Key env (Docker/Swarm secret), then blank the value in appsettings.json. Rotate every exposed credential after it's out of source (they must be treated as already compromised).

Suggested bounded first slice (no architecture decision needed): pick the highest-risk few (Encryption:MasterKey, Keycloak:*:secret, Twilio:AuthToken) and move them to injected env + blank in source, once the deploy confirms the env vars are actually set (else the app loses the value on boot). I can prep that PR if you confirm the prod deployment already injects — or will inject — these as env/secrets; without that confirmation, blanking them would break boot, so it's the one gate here.

(Context: found while shipping webhook HMAC validation — Twilio #165 (merged), SonarQube #166. Both reference Twilio:AuthToken / a SonarQube secret from config.)

### Verified finding — live secrets hardcoded in `SpikerSoft.Api/appsettings.json` (surfaced while adding webhook-signature validation) Committed **production** credentials currently in source (listing keys only, not values): - `Twilio:AuthToken` — Twilio account auth token (also the key that signs webhook HMACs, so it's security-critical). - `Encryption:MasterKey` — a base64 AES master key. - `InfluxDB:Token` / `InfluxDashboard:Token` — InfluxDB API token (same value in both blocks). - `Keycloak:backend-api:secret` and `Keycloak:health-check:secret` — Keycloak client secrets. Anyone with repo read access has these. Because .NET config layering lets environment variables override `appsettings.json`, the migration is low-risk per key: inject each as `Section__Key` env (Docker/Swarm secret), then blank the value in `appsettings.json`. Rotate every exposed credential after it's out of source (they must be treated as already compromised). Suggested bounded first slice (no architecture decision needed): pick the highest-risk few (`Encryption:MasterKey`, `Keycloak:*:secret`, `Twilio:AuthToken`) and move them to injected env + blank in source, once the deploy confirms the env vars are actually set (else the app loses the value on boot). I can prep that PR if you confirm the prod deployment already injects — or will inject — these as env/secrets; without that confirmation, blanking them would break boot, so it's the one gate here. (Context: found while shipping webhook HMAC validation — Twilio #165 (merged), SonarQube #166. Both reference `Twilio:AuthToken` / a SonarQube secret from config.)
spikerj commented 2026-07-22 04:51:39 +00:00
Author
Owner
Copy Link
Copy Source

Board-sweep status (2026-07-22) — this ticket's notes predate the OpenBao rollout, so catching it up: the epic it seeded (#543/#545/#546) has landed the core: SpikerSoft.Api/appsettings.json now carries blank values for all 12 API credentials (incl. every key the 07-06 comment listed — Twilio:AuthToken, Encryption:MasterKey, Influx tokens, Keycloak client secrets), served from OpenBao with strict fail-fast when Secrets__UseBao=true (merged #546 stage-4, backend 4bcec842). CI secrets are Bao-fetched repo-wide (two AppRole secrets per repo).

Still open before this go-live gate closes: (1) rotation of the previously-committed values — they must be treated as compromised; #600 tracks the Influx token, #633 the dev-environment set; (2) the worker-fleet Bao overlay rollout is ~26 of 60 stacks (#546's remaining batches); (3) plaintext creds in .env-10N files on the shared mount (flagged in #554). Leaving open as the go-live umbrella for those.

Board-sweep status (2026-07-22) — this ticket's notes predate the OpenBao rollout, so catching it up: the epic it seeded (#543/#545/#546) has landed the core: `SpikerSoft.Api/appsettings.json` now carries **blank values for all 12 API credentials** (incl. every key the 07-06 comment listed — Twilio:AuthToken, Encryption:MasterKey, Influx tokens, Keycloak client secrets), served from OpenBao with strict fail-fast when `Secrets__UseBao=true` (merged #546 stage-4, backend `4bcec842`). CI secrets are Bao-fetched repo-wide (two AppRole secrets per repo). **Still open before this go-live gate closes:** (1) rotation of the previously-committed values — they must be treated as compromised; #600 tracks the Influx token, #633 the dev-environment set; (2) the worker-fleet Bao overlay rollout is ~26 of 60 stacks (#546's remaining batches); (3) plaintext creds in `.env-10N` files on the shared mount (flagged in #554). Leaving open as the go-live umbrella for those.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels agentic
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#404