pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-04 22:32:12 +03:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): scrub hardcoded live-instance creds from boundary tests (#6786)

Browse Source 
The 3 tests/boundary/*.live.test.ts files merged via #6786 hardcoded a real
Bearer API key, an auth_token JWT cookie, and a live instance URL. Replaced with
env reads (OMNIROUTE_TEST_BASE/BEARER/COOKIE), preserving the RUN_BOUNDARY_LIVE gate.
The leaked key/cookie must still be revoked/rotated on the affected instance and
purged from history separately (operator action).
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-07-12 02:53:37 -03:00
parent b5e75bb8fe
commit 2d321e1f52
4 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/maintenance/scrub-boundary-test-creds.md Normal file
View File

@@ -0,0 +1 @@
- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.