security: stop tracking data_folder/ working files (keep data_folder_example templates); pin git dep - #1162
Open
azoz778 wants to merge 1 commit into
Open
security: stop tracking data_folder/ working files (keep data_folder_example templates); pin git dep#1162azoz778 wants to merge 1 commit into
azoz778 wants to merge 1 commit into
Conversation
…t dep
- git rm --cached the tracked data_folder/{secrets,plain_text_resume,
work_preferences}.yaml so filling in real keys/PII no longer lands in git
history; files remain on disk. data_folder_example/ stays tracked.
- .gitignore: ignore data_folder/.
- requirements.txt: pin the git+ lib_resume_builder_AIHawk dependency to a
commit SHA (was an unpinned mutable branch -> install-time RCE surface).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J2pmHPESfajho7VL8WyGDF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prevents users' real credentials/PII from landing in git, and closes an install-time supply-chain window. From a security review.
Stop tracking the working
data_folder/files (keep thedata_folder_example/templates):git rm --cached data_folder/{secrets,plain_text_resume,work_preferences}.yaml— these are the files users fill in with their real LLM API key, resume, and preferences. Because they're tracked, agit add -A/git commitsilently commits secrets + PII (and pushes them if the user forks/pushes). This untracks them; the files stay on disk, anddata_folder_example/remains tracked as the onboarding templates..gitignore— adddata_folder/.data_folder_example/: copydata_folder_example/→data_folder/, then edit. (If the README currently points users straight atdata_folder/, it may be worth a note to copy from the example dir first — happy to add that.)Pin the
git+dependency (requirements.txt):lib_resume_builder_AIHawkgit dependency was tracking a mutable branch, sopip installpulls whatever that branch points at at install time. Pinned to a specific commit SHA so installs are reproducible and can't silently change under you.No functional changes. Happy to adjust (e.g., README note, or a different pin) to fit your conventions.
🤖 This came out of an automated security review (Claude Code). Reviewed by the author before submitting.