adam/seahaven-site
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-site.git synced 2026-09-30 05:23:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
seahaven-site/.security-review/suppressions.json

17 lines
1.2 KiB
JSON
Raw Normal View History

INFRA-143: suppress reCAPTCHA site-key gitleaks FP + clear js-yaml DoS advisory (#27) * chore(security): suppress gitleaks FP on public reCAPTCHA site key (INFRA-143) The SITE_KEY in assets/js/form.js is a Google reCAPTCHA v3 site key, public by design (shipped to the browser, passed to grecaptcha.execute). It is not a secret and is not rotated. Add a scoped repo-local gitleaks suppression with justification for the current (line 7) and historical (line 5) hits so the pre-push scanner stops blocking on it. * fix(deps): pin gray-matter js-yaml to 3.15.0 to clear DoS advisory (INFRA-143) gray-matter (transitive via @11ty/eleventy) pulled js-yaml 3.14.2, flagged by GHSA-h67p-54hq-rp68 (quadratic-complexity DoS in merge-key handling, moderate). Add a scoped nested npm override pinning gray-matter's js-yaml to ^3.15.0, the fixed 3.x release, leaving Eleventy's direct js-yaml 4.x untouched. npm audit now reports 0 vulnerabilities and the Eleventy build passes.
2026-07-08 16:21:21 -04:00
{
"suppressions": [
{
"id": "gitleaks-generic-api-key-7",
"justification": "False positive. assets/js/form.js:7 SITE_KEY is a Google reCAPTCHA v3 SITE key, which is public by design: it is shipped to every browser and passed to grecaptcha.execute() client-side (form.js:17,63). It is not a secret and must not be rotated. Pairs with the reCAPTCHA SECRET key held server-side. INFRA-143."
},
{
"id": "gitleaks-generic-api-key-5",
"justification": "False positive. Same public reCAPTCHA v3 SITE key as gitleaks-generic-api-key-7, flagged at assets/js/form.js:5 from an earlier commit (gitleaks scans git history). Public by design, not a secret. INFRA-143."
chore(security): suppress historical elementor gitleaks FP (INFRA-181) (#29) Adds a scoped suppression for gitleaks-generic-api-key-2464, a high-entropy false positive in a removed Elementor/WordPress minified vendor bundle that survives only in git history. Not a live secret. With INFRA-143's two reCAPTCHA suppressions, the pre-push scanner now passes cleanly on this repo (0 confirmed high, 3 suppressed) with no --no-verify needed.
2026-07-08 16:53:55 -04:00
},
{
"id": "gitleaks-generic-api-key-2464",
"justification": "False positive. gitleaks flags a high-entropy string at wp-content/plugins/elementor-pro/assets/js/notes/vendors-...-e4587e.js:2464 (a minified radix-ui vendor bundle: the token is a bundler variable, not a credential). This legacy WordPress/Elementor bundle was removed from the repo and survives only in git history, which gitleaks scans. Not a live secret, nothing to rotate. INFRA-181."
INFRA-143: suppress reCAPTCHA site-key gitleaks FP + clear js-yaml DoS advisory (#27) * chore(security): suppress gitleaks FP on public reCAPTCHA site key (INFRA-143) The SITE_KEY in assets/js/form.js is a Google reCAPTCHA v3 site key, public by design (shipped to the browser, passed to grecaptcha.execute). It is not a secret and is not rotated. Add a scoped repo-local gitleaks suppression with justification for the current (line 7) and historical (line 5) hits so the pre-push scanner stops blocking on it. * fix(deps): pin gray-matter js-yaml to 3.15.0 to clear DoS advisory (INFRA-143) gray-matter (transitive via @11ty/eleventy) pulled js-yaml 3.14.2, flagged by GHSA-h67p-54hq-rp68 (quadratic-complexity DoS in merge-key handling, moderate). Add a scoped nested npm override pinning gray-matter's js-yaml to ^3.15.0, the fixed 3.x release, leaving Eleventy's direct js-yaml 4.x untouched. npm audit now reports 0 vulnerabilities and the Eleventy build passes.
2026-07-08 16:21:21 -04:00
}
]
}
Reference in a new issue Copy permalink