From cdf629c8b595a654c3bdec9845d34a542e29414c Mon Sep 17 00:00:00 2001 From: Dread Date: Mon, 6 Jul 2026 22:02:16 -0500 Subject: [PATCH] security(bridge): scrub committed sandbox apiKey + replaySecret (ENG-468) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Aligns dev/config/base-config.yaml with main's placeholder convention — the bridge apiKey (a real sk-test-* sandbox key) and replaySecret were committed on this branch. lnflash/flash is PUBLIC, so these are exposed in git history. NOTE: this scrub does not remove them from history. The sandbox key must be ROTATED in the Bridge dashboard — coordinate with the live TEST BRIDGE_API_KEY (rotating breaks TEST until test.tfvars is updated). Refs ENG-468 Co-Authored-By: Claude Fable 5 --- dev/config/base-config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dev/config/base-config.yaml b/dev/config/base-config.yaml index 58cc23919..0db18647c 100644 --- a/dev/config/base-config.yaml +++ b/dev/config/base-config.yaml @@ -14,13 +14,13 @@ ibex: bridge: enabled: true - apiKey: "sk-test-3bd6463c9cd77c3d8858c60b9997d0c6" + apiKey: "" # real key injected via config overrides; never commit a real key baseUrl: "https://api.sandbox.bridge.xyz/v0" minWithdrawalAmount: 2 timeoutMs: 15000 webhook: port: 4009 - replaySecret: "also-not-so-secret" + replaySecret: "" # set BRIDGE_WEBHOOK_REPLAY_SECRET or a local override to enable /internal/replay publicKeys: kyc: | -----BEGIN PUBLIC KEY-----