Audit — 2026-07-25
Frozen snapshot — do not update. Kept for how a decision was reached, not for what is true now. Current state lives in Architecture → Current State.
Four parallel audits over all 10 repos: secrets (full git history, every commit), Firebase security posture, git/dependency hygiene, and the GPU backend. Findings ranked by severity. Secret values redacted throughout.
P0 — CRITICAL: live secrets in pushed GitHub history (acesense-gpu-backend)
All five items below are in commits that are ancestors of origin/main on git@github-acesense:Acesense/acesense-gpu-backend.git — they are fetchable by anyone who can clone. Deleting them from the working tree changed nothing.
| # | Secret | Historical path | Window |
|---|---|---|---|
| 1 | GCP service-account private key — acesense-prod (PRODUCTION) (runpod@acesense-prod.iam.gserviceaccount.com, key id 360da8c7…a33a) | firebasecred/acesense-prod-360da8c714c2.json | 94dfdf0 2026-01-14 → 6505449 2026-01-15 |
| 2 | Firebase Admin SDK key — acesense-6fd55 (key id 1551dbe9…9bf4; full bypass of Firestore/Storage rules) | firebasecred/acesense-6fd55-…json | 8ab7984 2025-12-18 → 94dfdf0 |
| 3 | Anthropic API key (sk-ant-api…9gAA) | firebasecred/anthropic-api, anthropic-api | → 6505449 |
| 4 | RunPod key rpa_4CYYOA…x1w8 | 13 files: test/monitor scripts, functions/main.py, docs | since fb979a0 2025-11-09 |
| 5 | RunPod key rpa_56OV7U…u3hq | scripts/deploy_test.sh ×2 | 1360c2f → 2121d33 |
Remediation, in this exact order:
- Rotate/revoke all five at the provider consoles FIRST (GCP IAM by key id, RunPod console, Anthropic console). Purging history before rotating only hides live keys. Audit GCP/RunPod/Anthropic usage logs from 2025-11-09 onward.
- Purge history:
git filter-repo --path firebasecred --path anthropic-api --invert-pathsplus--replace-textfor the tworpa_literals; force-push all refs/tags. - GitHub Support ticket to expire cached views of old SHAs (force-push alone leaves them reachable); collaborators re-clone.
- Add a scheduled full-history gitleaks run — the per-repo
secret-scan.ymlonly scansBASE_SHA..HEAD_SHAand structurally cannot catch these.
Good news: the previously feared auth-function OAuth-token leak is a non-issue — full
Was this page helpful?