security: redact a live Cloudflare Global API Key from setup docs#36
Merged
Conversation
CLOUDFLARE-SETUP.adoc published a live Cloudflare GLOBAL API KEY as a literal value, in a PUBLIC repository, in a document instructing the reader to paste it into GitHub Actions secrets. A Global Key is not scoped. Paired with the account email it grants full account access — every zone, all DNS, and billing. The same key was also hardcoded in cloudflare-dns-terraform/auto-add-new-sites.sh (removed in that repo's #23); GitHub code search across the account now returns this as the last remaining copy on a default branch. Replaced with instructions to mint a SCOPED token (Cloudflare Pages: Edit), an explicit warning against using the Global Key, and a standing note that credentials must never be written into this file — a setup document should say where a secret goes, never what it is. ROTATION IS STILL REQUIRED. This removes the key from the default branch, not from history: it remains readable in earlier commits of this repo and of cloudflare-dns-terraform, both public. Public repos are scraped continuously, so the key must be assumed compromised regardless of this commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
implementations/wokelang/CLOUDFLARE-SETUP.adocpublished a live Cloudflare Global API Key as a literal value, in a public repository, in a document telling the reader to paste it into GitHub Actions secrets.A Global Key is not scoped. Paired with the account email it grants full account access — every zone, all DNS, and billing.
Scope of the exposure
The same key was also hardcoded in
cloudflare-dns-terraform/auto-add-new-sites.sh(removed in that repo's #23). GitHub code search across the account now returns this file as the last remaining copy on a default branch:The change
Replaced with instructions to mint a scoped token (Cloudflare Pages: Edit), an explicit warning against the Global Key, and a standing note that credentials must never be written into this file — a setup document should say where a secret goes, never what it is.
This removes the key from the default branch, not from history. It stays readable in earlier commits of this repo and of
cloudflare-dns-terraform— both public. Public repos are scraped continuously; the key must be assumed compromised regardless of this commit.Owner actions:
🤖 Generated with Claude Code