2 commits

Author	SHA1	Message	Date
Adam Moussa	311eab35c0	fix(auth): require Google authentication in cloud mode (#90) ... * fix(auth): require Google authentication in cloud mode Remove the public shared-key mechanism and fail closed on Google auth while adding submit-route throttling. * fix(auth): address review follow-ups Fail closed on whitespace-only Google configuration and centralize shared authentication behavior. * test(auth): use non-secret Google client fixture Make the public test identifier explicit so secret scanning does not misclassify it as an API key. * test(auth): avoid OAuth-shaped fixture Use a format-neutral audience value so secret scanning can distinguish the fixture from a real client identifier. * chore(security): suppress public OAuth fixture Document the scanner false positive without suppressing any runtime credential flow.	2026-08-03 13:51:12 -04:00
Adam Moussa	e2d1b2fce8	chore(security): add repo-local suppression for test-fixture FP (gitleaks-45) (#48) ... Moves the false-positive suppression for tests/test_submit_order.py:45 (a dummy test API key, proof-or-kill verified 2026-07-13) from machine-level to a tracked repo-local .security-review/suppressions.json so the Open SWE daily-report automation — which cannot see ~/.config on the Mac — resolves it. Machine-level copy retained until this merges.	2026-07-13 14:30:43 -04:00