Repository navigation
Purge token-in-URL git remotes; SSH-only remote policy #69
Description
Security: repos/ci had an x-access-token:gho_… token embedded in its origin URL (a 2nd clone of claude-integrations). Scrubbed to SSH this session.
Scope: audit all /dev clones for x-access-token:/PAT-in-URL remotes; switch to SSH; document SSH-only remote policy; ROTATE the exposed gho_ token on GitHub.
Acceptance: no token-in-URL remotes; policy documented in standards; token rotated.
Parent: #66
Activity
hyperpolymath commentedon May 16, 2026
Policy + audit done in standards#76 (
REMOTE-URL-POLICY.adoc). Audit 2026-05-17: 0 token-in-URL remotes across 20~/devclones. One item remains and is owner-only: rotate the exposedgho_token at github.com/settings/tokens (manual browser action — cannot be automated from here).docs: SSH-only git remote URL policy (Refs #69) (#76)
chore(enforcement): wire standards#67/#68 — JS-RUNTIME-POLICY.adoc + …
fix(security): enforce SSH-only git remotes estate-wide (standards#69) (
hyperpolymath commentedon May 19, 2026
Progress 2026-05-19 (keeping OPEN):
.git/configunder/home/hyperpolymath/devfound 1 offender (repos/file-souphadgho_****in origin); switched to SSH and verified; final re-scan = 0 offenders.REMOTE-URL-POLICY.adocv1.1.0 + governance-reusable.ymlsecurity-policystep (x-access-token:,:gho_,:ghp_,:ghs_,:github_pat_) landed in standards#147.gho_1q9dB2…(was in file-soup origin) must be revoked at https://github.com/settings/tokens.Remaining for close: token rotation by owner.
hyperpolymath commentedon May 20, 2026
Closure-ready — all 3 acceptance criteria met (2026-05-20)
repos/file-souporigin scrubbed to SSH; estate-wide re-scan = 0 token-in-URL remotesSSH-remote policystep that grepsx-access-token:,:gho_,:ghp_,:ghs_,:github_pat_)x-access-token:gho_…URL pattern was the gh CLI's signature. Re-authed viagh auth loginfor a fresh token; the leakedgho_1q9dB2…is now deadReady to close per joint-close convention — owner action.
🤖 Generated with Claude Code
hyperpolymath commentedon May 20, 2026
Closing per owner approval — all 3 acceptance criteria met (see prior comment).
fix(baseline): file_pattern glob matching + jq scoping bugs (#180)