Rotate secrets exposed in git history #50

New Issue

cal · 2026-03-23T04:57:23Z

cal commented

2026-03-23 04:57:23 +00:00

Summary

PR #29 removed hardcoded secrets from the codebase, but they remain in git history and should be rotated.

Secrets to rotate

PD API bearer token (Tp3aO3jhYve5NJF1IqOmJTmk) — was hardcoded in db_calls.py. Regenerate in Paper Dynasty API admin.
Supabase service-role JWT — was hardcoded in scripts/supabase_doodling.py (file now deleted). JWT expiry is 2061, so it remains valid until rotated. Rotate in Supabase dashboard.

After rotation

Update the .env file on any machine running the card pipeline with the new PD API token
Verify pd-cards CLI still authenticates correctly
The Supabase JWT may not be actively used (the script it was in was deleted), but rotate it anyway as a hygiene measure

Priority

High — exposed credentials should be rotated promptly even though the repos are private.

## Summary PR #29 removed hardcoded secrets from the codebase, but they remain in git history and should be rotated. ## Secrets to rotate 1. **PD API bearer token** (`Tp3aO3jhYve5NJF1IqOmJTmk`) — was hardcoded in `db_calls.py`. Regenerate in Paper Dynasty API admin. 2. **Supabase service-role JWT** — was hardcoded in `scripts/supabase_doodling.py` (file now deleted). JWT expiry is 2061, so it remains valid until rotated. Rotate in Supabase dashboard. ## After rotation - Update the `.env` file on any machine running the card pipeline with the new PD API token - Verify `pd-cards` CLI still authenticates correctly - The Supabase JWT may not be actively used (the script it was in was deleted), but rotate it anyway as a hygiene measure ## Priority High — exposed credentials should be rotated promptly even though the repos are private.

cal referenced this issue from a commit

2026-04-01 16:59:06 +00:00

fix: scrub exposed API token from docs

cal referenced a pull request that will close this issue

2026-04-01 16:59:19 +00:00

fix: scrub exposed credentials from docs #52

cal closed this issue

2026-04-01 18:02:02 +00:00

cal commented

2026-04-01 18:03:28 +00:00

Resolved via PR #52

Real API token (Tp3aO3jhYve5NJF1IqOmJTmk) scrubbed from docs/PD_CARDS_CLI_REFERENCE.md — replaced with your-api-token-here placeholder
Full audit of tracked card-creation files found no Supabase JWT or Ladies5-Monogamy-Charter references
.env is gitignored; no additional example file gap in this repo

See paper-dynasty-database#9 for full rotation details (API_TOKEN rotated on prod + dev, POSTGRES_PASSWORD verified).

## Resolved via PR #52 - Real API token (`Tp3aO3jhYve5NJF1IqOmJTmk`) scrubbed from `docs/PD_CARDS_CLI_REFERENCE.md` — replaced with `your-api-token-here` placeholder - Full audit of tracked card-creation files found no Supabase JWT or `Ladies5-Monogamy-Charter` references - `.env` is gitignored; no additional example file gap in this repo See `paper-dynasty-database#9` for full rotation details (API_TOKEN rotated on prod + dev, POSTGRES_PASSWORD verified).

Sign in to join this conversation.