GitGuardian Category D refinement (GG-3)¶
Generated from API inventory GITGUARDIAN_ALERT_AUDIT.generated.json (2026-08-27T19:37:34.102695+00:00).
Scope: 49 Category D incidents remain open after Batch 1 close (7 lastvet-gates resolved 2026-08-27).
Refinement summary¶
| Recommended bucket | Count | Meaning |
|---|---|---|
| B-inert | 16 | Test fixtures, theme strings, marketing .env artifacts; batch close candidate |
| B-defer-T6 | 17 | Hosted Supabase nztgswcpnwggymncrnyx / Railway Tier 6 bundle; services deleted or migrated; close after Tier 6 sign-off |
| D-live | 7 | GitGuardian valid or real payment/comms API; rotate before close |
| D-live? | 4 | Unlabeled .env high-entropy; identify then rotate or close |
| D (unclassified) | 5 | Needs manual sub-bucket |
Machine-readable: GITGUARDIAN_CATEGORY_D_REFINEMENT.generated.json
D1 — last1.id related (10 incidents touching Last-1-Enterprises/last1.id)¶
Deleted services context (W7 teardown):
| Service | Status | Notes |
|---|---|---|
Hosted Supabase nztgswcpnwggymncrnyx |
Deleted W7-3 | Pooler refs in gate-b-dump.sh only; DB gone |
| Railway last1.id | Deleted W7-4 | No Railway deploy target |
Sovereign R940 (auth.last1.id) |
Live | Uses separate BWS keys; no overlap with leaked hosted JWTs (sanity check PASS) |
Recommendation: 7 of 10 are B-inert or B-defer-T6 (batch close authorized after Ryan sign-off). 1 is D-live (Twilio cross-repo). 2 are test JWTs in server test files (B-defer-T6 / inert).
| ID | Detector | Validity | Paths | Rec | Action |
|---|---|---|---|---|---|
| 29160799 | Generic Private Key | failed_to_check | server/test-vectors/common/keys.json | B-inert | Batch close when Ryan approves D1-test (fixture keys, not production) |
| 29160800 | Cloudflare Turnstile Secret Keys | no_checker | .env.example | B-inert | Batch close when Ryan approves (example placeholder) |
| 29160801 | Twilio Master Credentials | valid | .env, .env.example | D-live | Rotate if key still active in Stripe/SendGrid/Twilio/Anthropic dashboards |
| 29160802 | Generic Private Key | failed_to_check | server/test-vectors/common/keys.json | B-inert | Batch close when Ryan approves D1-test (fixture keys, not production) |
| 29160803 | Generic Private Key | failed_to_check | server/test-vectors/common/keys.json | B-inert | Batch close when Ryan approves D1-test (fixture keys, not production) |
| 29160804 | Generic Private Key | failed_to_check | server/test-vectors/common/keys.json | B-inert | Batch close when Ryan approves D1-test (fixture keys, not production) |
| 29160805 | JSON Web Token | no_checker | .env.example, bitwarden/import-matrix-secrets.sh | B-defer-T6 | RadioCheck shared Tier 6 Supabase bundle |
| 33094461 | JSON Web Token | no_checker | server/lib/piiScrubber.test.ts | B-defer-T6 | Defer Tier 6; hosted last1.id + Railway deleted W7-3/4 |
| 33096680 | JSON Web Token | no_checker | server/lib/logRedaction.test.ts | B-defer-T6 | Defer Tier 6; hosted last1.id + Railway deleted W7-3/4 |
| 33102490 | Generic High Entropy Secret | no_checker | packages/sdk-nextjs/test/handler.test.js | B-inert | Batch close when Ryan approves D1-test (fixture keys, not production) |
D2 — last1.app related (16 incidents touching Last-1-Enterprises/last1.app)¶
What the leaked keys authenticate to:
| Detector group | Service | Incidents | GG validity | Recommendation |
|---|---|---|---|---|
stripe_keys |
Stripe API (payments) | 29615724, 29615733 | invalid / valid | Rotate 29615733 if Stripe dashboard key still active; 29615724 likely dead |
stripe_webhook_secret |
Stripe webhook HMAC | 29615730 | no_checker | Rotate webhook secret if endpoint live |
sendgrid_key |
SendGrid email | 29615727 | invalid | Likely rotated/dead; verify SendGrid dashboard |
twilio_master_credentials |
Twilio SMS/voice | 29160801 | valid | Rotate if Twilio subaccount still used |
claude_api_key |
Anthropic Claude | 29615732 | valid | Rotate Anthropic key if still billed |
postgresql_credentials |
Hosted Supabase Postgres | 29160797, 29615726, 29615728 | valid / no_checker | B-defer-T6 — pooler URLs for deleted/migrated project |
json_web_token |
Supabase anon/service JWT | 29160796, 33887929, 33887930 | no_checker | B-defer-T6 — Tier 6 shared bundle in .env / Vercel exports |
generic_high_entropy_secret |
Unknown .env secret |
29615725, 29615731 | no_checker | D-live? — identify in BWS / .env archive |
generic_password |
CI workflow password | 33888797 | no_checker | B-inert — review .github/workflows/ci.yml placeholder |
| ID | Detector | Validity | Paths | Rec | Service |
|---|---|---|---|---|---|
| 29160796 | JSON Web Token | no_checker | .env, bitwarden/smoke-last1app.sh | B-defer-T6 | Supabase JWT / auth token |
| 29160797 | PostgreSQL Credentials | valid | .env | B-defer-T6 | PostgreSQL database |
| 29160801 | Twilio Master Credentials | valid | .env, .env.example | D-live | Twilio SMS/voice |
| 29615724 | Stripe Keys | invalid | .env | D-live | Stripe API (payments) |
| 29615725 | Generic High Entropy Secret | no_checker | .env | D-live? | Unknown high-entropy secret (.env) |
| 29615726 | PostgreSQL Credentials | failed_to_check | .env | B-defer-T6 | PostgreSQL database |
| 29615727 | SendGrid Key | invalid | .env | D-live | SendGrid email |
| 29615728 | PostgreSQL Credentials | failed_to_check | .env | B-defer-T6 | PostgreSQL database |
| 29615730 | Stripe Webhook Secret | no_checker | .env | D-live | Stripe webhook verification |
| 29615731 | Generic High Entropy Secret | no_checker | .env | D-live? | Unknown high-entropy secret (.env) |
| 29615732 | Claude API Key | valid | .env | D-live | Anthropic Claude API |
| 29615733 | Stripe Keys | valid | .env | D-live | Stripe API (payments) |
| 29615734 | Generic High Entropy Secret | no_checker | .env | D-live? | Unknown high-entropy secret (.env) |
| 33887929 | JSON Web Token | no_checker | .env.vercel.local | B-defer-T6 | Supabase JWT / auth token |
| 33887930 | JSON Web Token | no_checker | .env.vercel.production | B-defer-T6 | Supabase JWT / auth token |
| 33888797 | Generic Password | no_checker | .github/workflows/ci.yml | B-inert | Password string |
Other sub-groups (defer — not closed)¶
| Sub | Repos | Count | Default recommendation |
|---|---|---|---|
| D3 | RealOutcomes | 6 | Stripe/OpenAI D-live; Supabase B-defer-T6 |
| D4 | RadioCheck (+ shared) | 5 | Tier 6 Supabase bundle B-defer-T6 |
| D5 | onset-ios | 4 | Staging xcconfig JWTs B-defer-T6 |
| D6 | norankhere-theme | 3 | Locale demo passwords B-inert |
| D7 | angel | 1 | Separate product D-live? |
| D8 | *-web marketing | 5 | Static .env JWT B-inert |
| D9 | last.vet-api | 1 | Test fixture B-inert |
Full per-incident rows: see GITGUARDIAN_CATEGORY_D_REFINEMENT.generated.json.
Proposed close batches (Ryan authorization required — NOT executed)¶
| Batch | IDs (count) | Prerequisite |
|---|---|---|
| D1-test/inert | 29160799–29160804, 33102490 (6) | Confirm test fixtures / .env.example only |
| D1-T6 defer | 29160805, 33094461, 33096680 (3) | Tier 6 hosted Supabase teardown sign-off |
| D2-T6 defer | JWT + Postgres bundle (~8) | Tier 6 sign-off |
| D2-live rotate | 29160801, 29615732, 29615733 (+ webhook 29615730) | Rotate in provider dashboards, then close |
| D6 theme | 33648235–33648237 (3) | Ryan OK for bulk inert close |
Do not bulk-close D-live rows until rotation confirmed.