docs(selfhost): describe what the starters actually ship for critical secrets - #6365
Conversation
… secrets preflight.ts's KNOWN_PLACEHOLDER_SECRETS comment claimed .env.selfhost.example / .env.example "ship these EXACT literal placeholder values" for the webhook HMAC secret and the static API/MCP/internal bearer tokens. Checked both files: that was never true of either, and the real shape is worth stating precisely, since a reader was being misled about which secrets ship exploitable defaults today. Every CRITICAL_SECRET_VARS entry ships COMMENTED OUT in both files, so the hazard is what an operator finds when they uncomment one. In .env.selfhost.example all five are commented and valueless, which yields a blank -- checkCriticalSecrets skips a blank outright, and a blank cannot be a publicly known value. .env.example is the same except SELFHOST_SETUP_TOKEN, whose commented line carries change-this-long-random-value: uncommenting it, the obvious way to turn the first-run wizard on, hands the operator a published token unless this set stops them. The comment now records that, plus the fact that .env.example repeats the same literal on POSTGRES_PASSWORD's commented line, which makes it read like the house placeholder rather than one var's. On whether the check is now dead for the four that ship valueless: it is not. The set is matched against whatever the operator actually SET, not against what the files ship, so it still fires wherever that literal is pasted. It is also the ONLY check that can catch it -- at 29 characters it passes MIN_SECRET_LENGTH's 20-char bar, so the length heuristic below would wave it straight through. change-this-32-byte-random-token ships in neither starter today; noted inline and kept, since retiring a once-published placeholder buys nothing when the match is against operator input. Comment-only: no executable line changes. Closes JSONbored#6285
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6365 +/- ##
=======================================
Coverage 95.60% 95.60%
=======================================
Files 599 599
Lines 47221 47221
Branches 15024 15024
=======================================
Hits 45147 45147
Misses 1290 1290
Partials 784 784
Flags with carried forward coverage won't be shown. Click here to find out more.
|
loopover-orb
Bot
added
the
gittensor:bug
|
Tip ✅ LoopOver review result - approve/merge recommendedReview updated: 2026-07-16 05:14:18 UTC
Review summary Nits — 5 non-blocking
Decision drivers
Context & advisory signals — never blocks the verdict
Linked issue satisfactionAddressed Review context
Contributor next steps
Signal definitions
🧪 Chat with LoopOverAsk LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.
Full command reference: https://loopover.ai/docs/loopover-commands 🧪 Experimental — new and may change. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed 💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →. Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.
|
![loopover-orb[bot]](https://avatars.githubusercontent.com/in/4139483?s=60&v=4){kind=small}
1 participant
Summary
KNOWN_PLACEHOLDER_SECRETS's comment insrc/selfhost/preflight.tstold the reader that.env.selfhost.example/.env.example"ship these EXACT literal placeholder values" for the webhook HMAC secret and the static API/MCP/internal bearer tokens. I checked both files: that was never true of either. A reader was being misled about which secrets ship exploitable defaults today.Comment-only -- no executable line changes.
What the starters actually ship
Every
CRITICAL_SECRET_VARSentry ships commented out in both files, so the real hazard is what an operator finds when they uncomment one:.env.selfhost.example# GITHUB_WEBHOOK_SECRET=, L34-48). Uncommenting yields a blank --checkCriticalSecretsskips a blank outright, and a blank cannot be a publicly known value..env.exampleSELFHOST_SETUP_TOKEN(L207), whose commented line carrieschange-this-long-random-value.So the one real exposure is
# SELFHOST_SETUP_TOKEN=change-this-long-random-value: uncommenting it is the obvious way to turn the first-run wizard on, and it hands the operator a published token unless this set stops them. That literal is also the string most likely to reach a var that ships valueless --.env.examplerepeats it onPOSTGRES_PASSWORD's commented line (L242), so it reads like the house placeholder rather than one var's. The comment now records exactly this.On the issue's second question -- is the check dead for the four that ship valueless?
No, and the reason is worth recording, so I put it in the comment rather than dropping entries:
change-this-long-random-valueis 29 chars, which passesMIN_SECRET_LENGTH's 20-char bar, so the length heuristic below would wave it straight through.change-this-32-byte-random-tokenships in neither starter today. Noted inline and kept as defence-in-depth -- retiring a once-published placeholder buys nothing when the match is against operator input.Scope
src/(a wanted path).site/,CNAME, orlovablechanges.Validation
npm run typecheck-- 0 errors.npx vitest run test/unit/selfhost-preflight.test.ts-- 18/18 pass (the only suite importingselfhost/preflight, confirmed by grep).git diff --check-- clean.upstream/main-- no base conflict.Safety
Closes #6285