n0mad1k
64b0ad01e0
- _prompt() clamps non-positive tuning values to default with operator warning (HIGH from AUDIT_SEC_989: prevents garbage display when vars file has masscan_rate: -100 or nuclei_concurrency: 0) - Remove empty 'if scan_mode in (...): pass' placeholder left from refactor (P3 from AUDIT_CODE_989) - Add AUDIT_CODE/SEC/ENV_989.md and FIXES_989.md with skip justifications (path traversal not applicable to single-operator threat model; Tor wording already adequate; estimate disclosure interactive-only)
3.0 KiB
3.0 KiB
agent, status, timestamp, findings_count, errors
| agent | status | timestamp | findings_count | errors |
|---|---|---|---|---|
| env-validator | PASS | 2026-05-02T00:00:00Z | 0 |
Env Validation — DevTrack #989
Summary
Comprehensive secrets hygiene audit for webrunner estimator rewrite (provider_rates.py and deploy_webrunner.py). All checks passed.
PASS
Secrets in source
- provider_rates.py: Clean. Contains only tuning constants (rate tables, timing defaults, cost multipliers). No API keys, tokens, passwords, or credential patterns detected.
- deploy_webrunner.py: Clean. Contains no hardcoded secrets. All credential handling is delegated to provider-specific utilities (linode_utils, aws_utils, flokinet_utils) which retrieve secrets from Infisical at runtime.
API key/token patterns
Searched all files for:
ghp_[A-Za-z0-9_]+(GitHub tokens) — NOT FOUNDsk_live_[A-Za-z0-9]+orsk_test_[A-Za-z0-9]+(Stripe) — NOT FOUNDAKIA[A-Z0-9]{16}(AWS access keys) — NOT FOUNDBearer [A-Za-z0-9._-]{20,}(bearer tokens) — NOT FOUNDpassword\s*=\s*["'][^"']{8,}(hardcoded passwords) — NOT FOUNDapi[_-]?key\s*=\s*["'][^"']{10,}(API keys) — NOT FOUND
.env file content
- No new .env files created in either module
- No .env file writes detected in code
- Tuning parameters stored in safe yaml configs:
inputs/targets.yaml— target definitions, probe patterns, vulnerability tags onlyinputs/countries.yaml— country codes, priority levels, exclude lists only- User-supplied vars files (optional) — only tuning parameters (masscan_rate, nmap_timing, hit_rate, etc.)
Credential handling verification
All provider credentials properly retrieved from Infisical:
- Linode:
creds get LINODE_TOKEN homelab(linode_utils.py:16-19) - AWS:
creds get AWS_ACCESS_KEY_ID homelabandcreds get AWS_SECRET_ACCESS_KEY homelab(aws_utils.py:17-24) - Fallback to vars file templates only (marked as placeholders like 'YOUR_AWS')
- No secrets persisted to disk; only set in
os.environin memory (deployment_engine.py:set_provider_environment)
Git history check
- No secrets in recent commits to these files
- 16 commits to webrunner module examined (latest: "Phase-accurate webrunner cost/time estimator...")
- Notable commit: "Fix P1 WEBRUNNER deployment failures and secret leakage" (
18039b2) — prior leak was addressed and fixed - No secret patterns detected in any commit
Code review
provider_rates.py(209 lines): Pure computation — estimate_scan_hours(), build_estimate_table(), formatting helpers. No file I/O, no env var access.deploy_webrunner.py(617 lines): Parameter gathering and deployment orchestration. All secrets retrieved via subprocess calls tocredsbinary (lines 16-24 in provider utils). No new credential handling code introduced in this rewrite.
Findings
0 issues.
No hardcoded secrets, no .env writes, no credential handling added. Secrets flow:
User input → provider_utils → creds binary (Infisical) → os.environ (memory only)
This is correct per secrets management rules.