Gate 0.5 — Bitwarden secrets audit¶
Date: 2026-07-09
Command: lastvet-gates/scripts/audit-bitwarden-secrets.sh
Secrets Manager (lastvet project)¶
| Key | SM status | Gate 0.5 relevance |
|---|---|---|
VETERAN_SESSION_EXCHANGE_SECRET |
✅ Present | Required — iOS JWT + ROI harness |
VA_OPEN_DATA_API_KEY |
✅ Present | Required — Facilities leg (A3) |
VETERAN_JWT_SECRET |
✅ Present | API Bearer signing |
OAUTH_JWT_SECRET |
✅ Present | Onset OAuth |
PROVIDER_JWT_SECRET |
✅ Present | Provider portal |
LASTVET_APP_SECRET |
✅ Present | Last1 ID linking |
LAST1_PROOF_DRAINER_SECRET |
✅ Present | Internal |
LASTVET_INTERNAL_ADMIN_SECRET |
✅ Present | Admin |
ONSET_IDENTITY_ASSERTION_SECRET |
✅ Present | Onset Connect |
LAST1_WEBHOOK_SECRET |
✅ Present | Webhooks |
SENDGRID_API_KEY |
❌ Missing | ROI OTP email delivery |
STRIPE_SECRET_KEY |
❌ Missing | Not Gate 0.5 |
STRIPE_WEBHOOK_SECRET |
❌ Missing | Not Gate 0.5 |
DATABASE_APP_URL_PRODUCTION |
✅ Present | Track 3 RLS prod runtime pool |
MIGRATION_DATABASE_URL_PRODUCTION |
✅ Present | Prod migrations + boot DDL |
LASTVET_APP_PASSWORD_PRODUCTION |
✅ Present | Role rotation / disaster recovery |
DATABASE_APP_URL_STAGING |
✅ Present | Track 3 RLS staging runtime pool |
MIGRATION_DATABASE_URL_STAGING |
✅ Present | Staging migrations |
LASTVET_APP_PASSWORD_STAGING |
✅ Present | Staging role password |
GOOGLE_OAUTH_CLIENT_SECRET |
❌ Missing | Provider Google sign-in |
RAISE_EXPANSION_PASSWORD |
❌ Missing | Investor deck only |
RAISE_TRAJECTORY_PASSWORD |
❌ Missing | Investor deck only |
SM tally: 10 present · 6 missing (of 16 manifest keys)
iOS sync verification¶
lastvet-gates/scripts/sync-bitwarden-secrets.sh ios --auth sm
# → Wrote last.vet-ios/Secrets.xcconfig
Facilities live verify (node scripts/verify-facilities-sd.js) succeeded after sync — 11 SD MH facilities resolved (see docs/runbooks/gate-0.5/facilities-sd-verification.log).
Password Manager vault¶
Audit could not read PM vault (not logged in to bw CLI). SM is the source of truth for build-required secrets per bitwarden/secrets-manifest.json.
Action for temp-dev hire¶
cp lastvet-gates/.bitwarden.env.example lastvet-gates/.bitwarden.env+ SM access token./scripts/sync-bitwarden-secrets.sh all --auth sm- Add
SENDGRID_API_KEYto SM if ROI OTP email must work in staging/prod harness (currently blocks automated OTP leg without inbox access).