From 21403d5c1daf0892b8c8e4d76cf20ab46aa644b6 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 6 Aug 2026 02:44:00 +0100
Subject: [PATCH] =?UTF-8?q?fix(security):=20remove=20the=20hardcoded=20Clo?=
 =?UTF-8?q?udflare=20token=20=E2=80=94=20use=20wrangler=20OAuth?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

deploy-repos.sh exported a live CLOUDFLARE_API_TOKEN on line 5, in a PUBLIC
repository, and in git history.

THE TOKEN WAS NEVER NECESSARY. This is a local developer script — it runs
wrangler against $HOME/Documents/hyperpolymath-repos, not in CI. `wrangler
login` (OAuth) covers it completely: the session lives in ~/.config/.wrangler/,
no long-lived credential exists, and it is revocable from the dashboard. The
token existed because `export TOKEN=...` needs no setup step and OAuth needs
one. The cheapest option at authoring time became a published credential.

So this deletes rather than relocates it. There is nothing to move to a
secret store, because nothing needs a secret.

The account id on the next line is KEPT and is not a secret: Cloudflare treats
it as an ordinary identifier and it appears in dashboard URLs. It earns its
place because this login can see more than one account. A comment now says so,
so nobody "tidies" it into a secret and nobody reintroduces the token beside it.

Also switched `deno run -A npm:wrangler` to `bunx wrangler`, per the
Bun-over-Deno ruling. Both runtimes are installed; this is a one-word change.

Added .gitleaks.toml for the four remaining findings, all benign: deno.lock
integrity hashes, two setup docs describing where a bot token goes, and an
example carrying the literal `.token = "abc123def456..."` next to the comment
`// Would be real token`.

The exclusions are deliberately narrow and NOTHING in source or scripts is
suppressed. VERIFIED in both directions: findings go to 0, and re-introducing
a token into deploy-repos.sh is still caught. An allowlist that reopened the
hole this repository just had would be worse than no scanner.

⚠ THE EXPOSED TOKEN MUST STILL BE REVOKED. It has been public; removing it
from the file does not un-publish it. Dashboard → My Profile → API Tokens.
No replacement is needed once wrangler login is done.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .gitleaks.toml  | 34 ++++++++++++++++++++++++++++++++++
 deploy-repos.sh | 11 +++++++++--
 2 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..b7f2445
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# gitleaks configuration for avow-protocol.
+#
+# TWO SILENT SYNTAX TRAPS in the pinned gitleaks — both fail with NO error and
+# NO effect, so a config written either way looks correct and suppresses
+# nothing:
+#   1. The block must be `[allowlist]` (SINGULAR). `[[allowlists]]` is ignored.
+#   2. `regexes = [...]` is ignored; only `paths` is honoured.
+#
+# ⚠ NOTHING HERE SUPPRESSES SOURCE OR SCRIPTS. This repository had a REAL
+# Cloudflare API token committed in deploy-repos.sh and published for as long
+# as the repo has been public. The scanner found it only because it inspects
+# generic high-entropy strings — Cloudflare tokens carry no prefix, so
+# prefix-matching scanners miss them entirely. Keep these exclusions narrow.
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = """
+Lockfile integrity hashes and documentation placeholders.
+
+telegram-bot/deno.lock — content-addressed integrity hashes, machine-generated.
+telegram-bot/README.md, NEXT-STEPS.md — setup docs showing where a bot token
+goes, not a token.
+avow-lib/ffi/zig/src/example.zig — an example carrying the literal
+`.token = "abc123def456..."` with the trailing comment `// Would be real token`.
+"""
+paths = [
+  '''^telegram-bot/deno\.lock$''',
+  '''^telegram-bot/README\.md$''',
+  '''^telegram-bot/NEXT-STEPS\.md$''',
+  '''^avow-lib/ffi/zig/src/example\.zig$''',
+]
diff --git a/deploy-repos.sh b/deploy-repos.sh
index 71a793e..6c79e53 100755
--- a/deploy-repos.sh
+++ b/deploy-repos.sh
@@ -2,7 +2,14 @@
 # SPDX-License-Identifier: MPL-2.0
 # Deploy all repos to Cloudflare Pages
 
-export CLOUDFLARE_API_TOKEN="xjmFyko52yeQ-3DPYxDTOZwM3DYwqRFU84f0UN40"
+# Authentication is via `wrangler login` (OAuth), NOT an API token.
+# Run it once; wrangler stores the session under ~/.config/.wrangler/.
+# Do not reintroduce `export CLOUDFLARE_API_TOKEN=...` here — a token in a
+# tracked file is a published credential, and this repository is public.
+#
+# The account id below is NOT a secret: Cloudflare treats it as an ordinary
+# identifier and it appears in dashboard URLs. It is kept because this login
+# can see more than one account.
 export CLOUDFLARE_ACCOUNT_ID="b72dd54ed3ee66088950c82e0301edbb"
 
 REPOS_DIR="$HOME/Documents/hyperpolymath-repos"
@@ -39,7 +46,7 @@ for project in "${!PROJECTS[@]}"; do
 
   cd "$repo_path" || continue
 
-  deno run -A npm:wrangler pages deploy . --project-name="$project" --branch=main 2>&1 | grep -E "✨|Deployment complete|View your site"
+  bunx wrangler pages deploy . --project-name="$project" --branch=main 2>&1 | grep -E "✨|Deployment complete|View your site"
 
   if [ ${PIPESTATUS[0]} -eq 0 ]; then
     echo "   ✅ Deployed successfully"