2026-08-05 - 2026-08-12
Overview
2 Pull requests merged by 1 user
Merged
#29 Update golangci-lint to v2.12.2 with canonical config
Merged
#28 Add .editorconfig (closes #27)
1 Pull request proposed by 1 user
Proposed
#53 Make script/test fail on flaky failures and enable -race (closes #32)
4 Issues closed from 1 user
Closed
#45 script/bootstrap installs golangci-lint unpinned, so local lint diverges from CI
Closed
#30 Adopt canonical .golangci.yml and golangci-lint v2.12.2
Closed
#31 Decision needed: three commits on main carry vendor advertising trailers
Closed
#27 Add .editorconfig
25 Issues created by 1 user
Opened
#30 Adopt canonical .golangci.yml and golangci-lint v2.12.2
Opened
#31 Decision needed: three commits on main carry vendor advertising trailers
Opened
#32 script/test silently passes on flaky failures, and runs without -race or -timeout
Opened
#33 Critical: secret rm .. deletes the entire vault; rm/mv/import skip name validation
Opened
#34 No file locking and no atomic writes: concurrent or interrupted operations corrupt the vault
Opened
#35 memguard lifecycle is not wired up: Ctrl-C and error exits leave key material in locked memory unwiped
Opened
#36 KeychainData holds the age key passphrase as a plain string through JSON marshalling
Opened
#37 GetSecretVersion copies decrypted secrets out of locked memory into plain []byte
Opened
#38 age identity .String() creates unprotected copies of private keys at six call sites
Opened
#39 No confirmation prompt on any destructive operation
Opened
#40 .gitignore does not exclude secrets, and .dockerignore does not exclude .git
Opened
#41 Cobra prints full usage on internal failures, burying the actual error
Opened
#42 PGPUnlocker.GetID panics on corrupt metadata, and setMnemonicEnv re-exports the mnemonic
Opened
#43 Go module path is git.eeqj.de/sneak/secret, policy requires sneak.berlin/go/secret
Opened
#44 Makefile hardcodes a personal remote DOCKER_HOST, breaking make docker for everyone else
Opened
#45 script/bootstrap installs golangci-lint unpinned, so local lint diverges from CI
Opened
#46 README missing four required sections; TODO.md is stale and describes completed work as pending
Opened
#47 Error messages leak internals and offer no recovery path for corrupted key files
Opened
#48 CreatePGPUnlocker leaves a partial unlocker directory on disk when fingerprint resolution fails
Opened
#49 Tests assert on error message fragments, never on sentinel identity — error-handling regressions pass silently
Opened
#50 Darwin-only code is never compiled, linted, or tested by CI, including both hardware-backed unlockers
Opened
#51 checkUnlockerExists fails open: an unenumerable unlockers.d reports "no duplicate" and permits a duplicate unlocker
Opened
#52 Test suite cannot meet the 20s policy budget once -race is enabled: internal/cli 100MB boundary tests
Opened
#54 script/cibuild can report a cached green: docker build serves RUN make check layers from cache
Opened
#55 Run all linting in Docker via Dockerfile.lint + script/lint