docs(agents): stop enumerating where the credentials live #26

Merged
jlxq0 merged 1 commit from fix/agents-stop-enumerating-secret-locations into main 2026-09-02 00:24:29 +00:00
Owner

AGENTS.md named the 1Password store, both vaults it reaches, this app's item, the shared
registry-credential item, and a negative fact about a vault that does not exist. This
repository serves that file publicly on both remotes.

forge   raw AGENTS.md, no credential   HTTP 200
github  raw AGENTS.md, no credential   HTTP 200

Clark swept the twenty other public repositories in the estate: 0 op:// references,
0 files naming a vault beside a 1Password reference. The only other vault-word hit is a
matrix-mcp CHANGELOG line about a retired cluster with the hostname already sanitised, and
his instrument found it, so it could match. This is one file, not a class.

Why deleted rather than reworded

Not primarily because it is sensitive. Because this project's own rule is that nothing
goes in AGENTS.md which can be read from the running system
, and every name in that
paragraph is recoverable from the cluster's own ExternalSecrets. It should not have been
there on the day it was written, and its being public is what made anyone look.

The replacement is the two commands that answer it. Both were run verbatim as written
before committing
, which is the point of putting a command in a file rather than its
output:

$ kubectl -n typst-mcp get externalsecret -o jsonpath='...'
forge-secret store=onepassword-hanso
typst-mcp-secrets store=onepassword-hanso

$ kubectl -n typst-mcp get externalsecret typst-mcp-secrets -o jsonpath='...'
TYPST_MCP_API_KEYS <- .../API_KEYS
TYPST_MCP_TENANT_SALT <- .../TENANT_SALT
TYPST_MCP_SIGNING_SECRET <- .../SIGNING_SECRET
TYPST_MCP_OIDC_ISSUER <- .../OIDC_ISSUER

A reader recovers the store, both items and all four key mappings. Nothing is lost, and
what remains cannot go stale
, which the deleted paragraph could and eventually would.

What this does not do

It does not unpublish anything. The paragraph stays in history, which has been
anonymously fetchable on GitHub since 2026-08-17 and on Forge since 2026-09-01T23:49:16Z.
This stops the file serving those names at the path anyone reads first, and that is the
whole of its effect.

It does not decide the question. Whether the store, vault and item names belong in a
public repository at all is on #22 and is not mine. If the answer is that they are fine,
this change costs nothing and the file is still better for pointing at the cluster.

Severity, recorded on #22 rather than rated here

It is reconnaissance, not a credential: no op:// paths, no values, names in prose, plus a
negative fact that saves a reader a guess. Its weight comes from what sits behind those
names, which Clark reports is a separate exposure on another host. Neither is dangerous
alone and together they are a shorter path than either.
That belongs on #22 in those words
and not as a number here.

Also fixes a continuation line that had been indented under the wrong bullet since the
CLAUDE.md merge in #24.

`AGENTS.md` named the 1Password store, both vaults it reaches, this app's item, the shared registry-credential item, and a negative fact about a vault that does not exist. This repository serves that file publicly on both remotes. forge raw AGENTS.md, no credential HTTP 200 github raw AGENTS.md, no credential HTTP 200 Clark swept the twenty other public repositories in the estate: **0** `op://` references, **0** files naming a vault beside a 1Password reference. The only other vault-word hit is a `matrix-mcp` CHANGELOG line about a retired cluster with the hostname already sanitised, and his instrument found it, so it could match. **This is one file, not a class.** ## Why deleted rather than reworded Not primarily because it is sensitive. **Because this project's own rule is that nothing goes in `AGENTS.md` which can be read from the running system**, and every name in that paragraph is recoverable from the cluster's own ExternalSecrets. It should not have been there on the day it was written, and its being public is what made anyone look. The replacement is the two commands that answer it. **Both were run verbatim as written before committing**, which is the point of putting a command in a file rather than its output: $ kubectl -n typst-mcp get externalsecret -o jsonpath='...' forge-secret store=onepassword-hanso typst-mcp-secrets store=onepassword-hanso $ kubectl -n typst-mcp get externalsecret typst-mcp-secrets -o jsonpath='...' TYPST_MCP_API_KEYS <- .../API_KEYS TYPST_MCP_TENANT_SALT <- .../TENANT_SALT TYPST_MCP_SIGNING_SECRET <- .../SIGNING_SECRET TYPST_MCP_OIDC_ISSUER <- .../OIDC_ISSUER A reader recovers the store, both items and all four key mappings. **Nothing is lost, and what remains cannot go stale**, which the deleted paragraph could and eventually would. ## What this does not do **It does not unpublish anything.** The paragraph stays in history, which has been anonymously fetchable on GitHub since 2026-08-17 and on Forge since 2026-09-01T23:49:16Z. This stops the file serving those names at the path anyone reads first, and that is the whole of its effect. **It does not decide the question.** Whether the store, vault and item names belong in a public repository at all is on #22 and is not mine. If the answer is that they are fine, this change costs nothing and the file is still better for pointing at the cluster. ## Severity, recorded on #22 rather than rated here It is reconnaissance, not a credential: no `op://` paths, no values, names in prose, plus a negative fact that saves a reader a guess. Its weight comes from what sits behind those names, which Clark reports is a separate exposure on another host. **Neither is dangerous alone and together they are a shorter path than either.** That belongs on #22 in those words and not as a number here. Also fixes a continuation line that had been indented under the wrong bullet since the `CLAUDE.md` merge in #24.
docs(agents): stop enumerating where the credentials live
All checks were successful
CI / cargo (pull_request) Successful in 1m43s
CI / docker (pull_request) Successful in 33s
e17c3b3eb7
AGENTS.md named the 1Password store, both vaults it reaches, the app's own
item, the shared registry-credential item, and a negative fact about a vault
that does not exist. This repository serves that file publicly on both remotes,
and a sweep of the twenty other public repositories found no other file naming
a store, a vault or an item. One file, not a class.

It is reconnaissance rather than a credential: no op:// reference paths, no
values, names in prose. Its weight comes from what sits behind those names,
which is a separate exposure recorded on #22.

Deleted rather than reworded, because the project's own rule is that nothing
goes in this file which can be read from the running system, and every name in
that paragraph is recoverable from the cluster's own ExternalSecrets. Both
documented commands were run verbatim before committing and return the store,
both items and all four key mappings, so a reader loses nothing.

Removing it from HEAD does not unpublish it: it stays in history, which has
been anonymously fetchable since 2026-08-17, and whether the store, vault and
item names should be public anywhere is a decision on #22 that is not mine.
This stops the file serving them at the path anyone reads first.

Found by clark while measuring the public estate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018CXx4uyuDhqwungt4SMN4S
jlxq0 merged commit 123d55b2d3 into main 2026-09-02 00:24:29 +00:00
jlxq0 deleted branch fix/agents-stop-enumerating-secret-locations 2026-09-02 00:24:29 +00:00
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jlxq0/typst-mcp!26
No description provided.