spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

SECURITY: live InfluxDB token committed in SpikerSoft.Api/appsettings.json — needs rotation, not just deletion #600

New Issue
Open
opened 2026-07-14 22:12:30 +00:00 by spikerj · 2 comments
spikerj commented 2026-07-14 22:12:30 +00:00
Owner
Copy Link
Copy Source

Found while working #577. Flagging rather than fixing, because deleting it from HEAD does not fix it — the credential needs rotating.

What

SpikerSoft.Api/appsettings.json has an InfluxDashboard config block containing a plaintext 88-character InfluxDB token for https://influxdb.spikersoft.com (org spikersoft, bucket jetsons). It is committed, and it is in git history.

I have not printed the value anywhere and have not touched the file.

Why the block shouldn't even be there

The API doesn't stream Influx metrics at all — it touches InfluxDB solely through its health check. The whole InfluxDashboard section in the API's appsettings is vestigial copy-paste from the SpikerSoft.EventHandlers.InfluxDashboard worker (the worker's own README already called this out and said the section "is safe to delete; deleting it would also drop one more committed copy of the InfluxDB token").

So there are two separate problems and they need different actions:

  1. The token is exposed. Anyone with repo read access has it, and it is in history, so removing the line from HEAD leaves it fully recoverable. The token must be rotated in InfluxDB. Only after rotation does scrubbing HEAD mean anything.
  2. The config block is dead weight. Once the token is rotated, delete the whole InfluxDashboard section from SpikerSoft.Api/appsettings.json. Nothing in the API reads it. (Note #577 already removed WindowPeriod/TimeRangeStart from the options class, so two of the keys in this block now bind to nothing at all.)

Suggested sequence

  1. Rotate the InfluxDB token (Joey — infra action, and the only step that actually closes the exposure).
  2. Update the real consumers to the new token: the worker gets it via its stack file env in spikersoft-infrastructure, so confirm it is sourced from a Docker secret / env rather than a committed appsettings value.
  3. Delete the vestigial InfluxDashboard block from SpikerSoft.Api/appsettings.json.
  4. Consider a repo-wide sweep for other committed credentials, plus a guard test that fails the build if appsettings*.json contains a non-empty Token/Password/ApiKey value (the same "config that looks fine and isn't" family as #577/#584).

Steps 3 and 4 I can take once you have done step 1 — say the word.

Related: #577 (which surfaced this).

Found while working #577. **Flagging rather than fixing, because deleting it from HEAD does not fix it — the credential needs rotating.** ## What `SpikerSoft.Api/appsettings.json` has an `InfluxDashboard` config block containing a plaintext **88-character InfluxDB token** for `https://influxdb.spikersoft.com` (org `spikersoft`, bucket `jetsons`). It is committed, and it is in git history. I have not printed the value anywhere and have not touched the file. ## Why the block shouldn't even be there The API doesn't stream Influx metrics at all — it touches InfluxDB **solely through its health check**. The whole `InfluxDashboard` section in the API's appsettings is vestigial copy-paste from the `SpikerSoft.EventHandlers.InfluxDashboard` worker (the worker's own README already called this out and said the section "is safe to delete; deleting it would also drop one more committed copy of the InfluxDB token"). So there are two separate problems and they need different actions: 1. **The token is exposed.** Anyone with repo read access has it, and it is in history, so removing the line from HEAD leaves it fully recoverable. **The token must be rotated in InfluxDB.** Only after rotation does scrubbing HEAD mean anything. 2. **The config block is dead weight.** Once the token is rotated, delete the whole `InfluxDashboard` section from `SpikerSoft.Api/appsettings.json`. Nothing in the API reads it. (Note #577 already removed `WindowPeriod`/`TimeRangeStart` from the options class, so two of the keys in this block now bind to nothing at all.) ## Suggested sequence 1. Rotate the InfluxDB token (Joey — infra action, and the only step that actually closes the exposure). 2. Update the real consumers to the new token: the worker gets it via its stack file env in `spikersoft-infrastructure`, so confirm it is sourced from a Docker secret / env rather than a committed appsettings value. 3. Delete the vestigial `InfluxDashboard` block from `SpikerSoft.Api/appsettings.json`. 4. Consider a repo-wide sweep for other committed credentials, plus a guard test that fails the build if `appsettings*.json` contains a non-empty `Token`/`Password`/`ApiKey` value (the same "config that looks fine and isn't" family as #577/#584). Steps 3 and 4 I can take once you have done step 1 — say the word. Related: #577 (which surfaced this).
spikerj commented 2026-07-22 02:55:24 +00:00
Author
Owner
Copy Link
Copy Source

Partial — leaving open. On origin/master, SpikerSoft.Api/appsettings.json now has "InfluxDB": { … "Token": "" } (and the InfluxDashboard block's Token is "" too), so the secret is no longer committed in the current file.

But this ticket's core point stands: the leaked token is still in git history, so deletion alone doesn't close the exposure — the old token must be rotated/revoked on the InfluxDB server (influxdb.spikersoft.com) and the runtime value sourced from OpenBao. That rotation step isn't verifiable from the repo. Close only once the token has been revoked on the server and re-provisioned via Bao (per the secrets-in-openbao rule).

Partial — leaving open. On `origin/master`, `SpikerSoft.Api/appsettings.json` now has `"InfluxDB": { … "Token": "" }` (and the `InfluxDashboard` block's `Token` is `""` too), so the secret is no longer committed in the current file. But this ticket's core point stands: **the leaked token is still in git history**, so deletion alone doesn't close the exposure — the old token must be **rotated/revoked on the InfluxDB server** (`influxdb.spikersoft.com`) and the runtime value sourced from OpenBao. That rotation step isn't verifiable from the repo. Close only once the token has been revoked on the server and re-provisioned via Bao (per the secrets-in-openbao rule).
spikerj commented 2026-07-29 15:43:56 +00:00
Author
Owner
Copy Link
Copy Source

Audited against origin/master — the deletion half is done; the rotation half (the actual ask) is not verifiable from git. Staying open. Paths and lengths only, no values.

Deleted from HEAD. SpikerSoft.Api/appsettings.json → /InfluxDB/Token is now EMPTY, as is /InfluxDashboard/Token. This landed with backend PR #312, "retire committed plaintext secrets now served by OpenBao (#546)". The Bao seam is wired in the same file: /Secrets/Address and /Secrets/Mount are populated, and the neighbouring Keycloak/*/secret, Stripe/SecretKey, Stripe/WebhookSecret, Twilio/AuthToken, Email/Password, DnsServer/Token and Gitea/AccessToken are all EMPTY too. So this file is fully migrated.

Not settled — and this ticket's title is the reason it stays open: "needs rotation, not just deletion." The token remains in git history and is readable by anyone with repo access, so removing it from HEAD does not revoke it. Nothing in any repo can evidence whether the token was actually rotated in InfluxDB.

To close this, someone needs to confirm in InfluxDB that the previously-committed token has been revoked (not merely superseded) and that the replacement lives only in OpenBao. If that already happened, dropping a comment saying so is enough to close.

Related and still open: #633 item 2 — the InfluxDB admin token is still committed non-empty in SpikerSoft.EventHandlers.InfluxDashboard/appsettings.json → /InfluxDB/Token (len 88). So even with this file clean, a live InfluxDB credential is still in the tree elsewhere. Worth doing the rotation once and clearing both.

Audited against `origin/master` — **the deletion half is done; the rotation half (the actual ask) is not verifiable from git.** Staying open. Paths and lengths only, no values. **Deleted from HEAD.** `SpikerSoft.Api/appsettings.json` → `/InfluxDB/Token` is now **EMPTY**, as is `/InfluxDashboard/Token`. This landed with backend PR #312, *"retire committed plaintext secrets now served by OpenBao (#546)"*. The Bao seam is wired in the same file: `/Secrets/Address` and `/Secrets/Mount` are populated, and the neighbouring `Keycloak/*/secret`, `Stripe/SecretKey`, `Stripe/WebhookSecret`, `Twilio/AuthToken`, `Email/Password`, `DnsServer/Token` and `Gitea/AccessToken` are all EMPTY too. So this file is fully migrated. **Not settled — and this ticket's title is the reason it stays open:** *"needs rotation, not just deletion."* The token remains in git history and is readable by anyone with repo access, so removing it from HEAD does not revoke it. Nothing in any repo can evidence whether the token was actually rotated in InfluxDB. To close this, someone needs to confirm in InfluxDB that the previously-committed token has been revoked (not merely superseded) and that the replacement lives only in OpenBao. If that already happened, dropping a comment saying so is enough to close. Related and still open: **#633** item 2 — the InfluxDB admin token is still committed **non-empty** in `SpikerSoft.EventHandlers.InfluxDashboard/appsettings.json` → `/InfluxDB/Token` (len 88). So even with this file clean, a live InfluxDB credential is still in the tree elsewhere. Worth doing the rotation once and clearing both.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#600