security: real MQTT credentials in git history (commits 85e8659, 2e56a99, 8efe761)

time commented

2026-09-17 23:32:57 +00:00

Commit 85e8659 added .env.example containing real credentials: MQTT_USER=wxbug, MQTT_PASSWORD=weatherornot, MQTT_HOST=ha.cryogen.cc, and docs referenced internal broker IP 192.168.1.100. 8efe761 replaced them with placeholders, so HEAD is clean, but the credentials persist in the history of origin/main and origin/feature/eas-alert-testing (and all local branches). Fix: rotate the wxbug MQTT credential on the broker, then (if the repo is ever made public) rewrite history with git filter-repo and force-push. Repo is private as of 2026-09-14, so cleanup is deferred.

Commit 85e8659 added .env.example containing real credentials: MQTT_USER=wxbug, MQTT_PASSWORD=weatherornot, MQTT_HOST=ha.cryogen.cc, and docs referenced internal broker IP 192.168.1.100. 8efe761 replaced them with placeholders, so HEAD is clean, but the credentials persist in the history of origin/main and origin/feature/eas-alert-testing (and all local branches). Fix: rotate the wxbug MQTT credential on the broker, then (if the repo is ever made public) rewrite history with git filter-repo and force-push. Repo is private as of 2026-09-14, so cleanup is deferred.

time commented

2026-09-18 04:06:36 +00:00

Author

No code change needed: config.py already uses python-dotenv with a gitignored .env and a placeholder .env.example. Remaining work is (1) rotate the wxbug credential on the broker, (2) rewrite history with git filter-repo + force-push before any public push. Deferred while repo stays private.

daru commented

2026-09-30 08:35:10 +00:00

Owner

resolved

daru closed this issue

2026-09-30 08:35:10 +00:00

Rows
Columns

security: real MQTT credentials in git history (commits 85e8659, 2e56a99, 8efe761) #1

security: real MQTT credentials in git history (commits `85e8659`, `2e56a99`, `8efe761`) #1