[cleanup] Truncate logs/app.log to remove leaked auth header #7

New issue

Closed

opened 2026-07-01 16:06:32 -04:00 by jmcqueen · 1 comment

jmcqueen commented

2026-07-01 16:06:32 -04:00

Owner

Historical entries in logs/app.log contain the base64-encoded Authorization: Basic … header from the old "Assets AQL curl for debugging" log line (already removed from source in this branch). Even after the Jira API token is rotated, this file is worth truncating so it doesn't ship stale credentials into any backup / snapshot / container image.

Steps:

: > logs/app.log
Confirm nothing else on disk still references the old token: rg 'ATSTT3xFfGF|d2ViZXgtYm90' logs/ /tmp/

logs/ is .gitignored, so this is a local-only cleanup.

Historical entries in `logs/app.log` contain the base64-encoded `Authorization: Basic …` header from the old "Assets AQL curl for debugging" log line (already removed from source in this branch). Even after the Jira API token is rotated, this file is worth truncating so it doesn't ship stale credentials into any backup / snapshot / container image. **Steps:** - `: > logs/app.log` - Confirm nothing else on disk still references the old token: `rg 'ATSTT3xFfGF|d2ViZXgtYm90' logs/ /tmp/` `logs/` is `.gitignore`d, so this is a local-only cleanup.

jmcqueen added this to the v1: Jira lifecycle GA milestone 2026-07-01 16:06:32 -04:00

jmcqueen added the

cleanup

label 2026-07-01 16:06:32 -04:00

jmcqueen commented

2026-07-01 16:48:07 -04:00

Author

Owner

Done locally (not committed — logs/ is .gitignored).

Before: logs/app.log = 228,569 bytes with 171 lines matching the leaked Basic <base64> Authorization header from prior debug logging.
After: both logs/app.log and logs/webex-callbacks.log truncated to 0 bytes.

Ran a repo-wide sweep for the leaked-token signatures (ATATT3xFfGF|ATSTT3xFfGF|xai-HuVvBmB5|d2ViZXgtYm90|BEGIN * PRIVATE KEY) with logs/ and node_modules/ excluded — no matches. .env still contains live tokens but is .gitignored.

The tokens themselves still need to be treated as compromised at some point (see issue #1's blocker context) — truncation only stops the leak from spreading via a future log-share, not from any copy that was previously in memory or an offsite log ingest.

Done locally (not committed — `logs/` is `.gitignore`d). Before: `logs/app.log` = 228,569 bytes with 171 lines matching the leaked `Basic <base64>` Authorization header from prior debug logging. After: both `logs/app.log` and `logs/webex-callbacks.log` truncated to 0 bytes. Ran a repo-wide sweep for the leaked-token signatures (`ATATT3xFfGF|ATSTT3xFfGF|xai-HuVvBmB5|d2ViZXgtYm90|BEGIN * PRIVATE KEY`) with `logs/` and `node_modules/` excluded — no matches. `.env` still contains live tokens but is `.gitignore`d. The tokens themselves still need to be treated as compromised at some point (see issue #1's blocker context) — truncation only stops the leak from spreading via a future log-share, not from any copy that was previously in memory or an offsite log ingest.

jmcqueen closed this issue

2026-07-01 16:48:07 -04:00