Issues - secret - git.eeqj.de

sneak/secret

Labels Milestones New Issue

Run all linting in Docker via Dockerfile.lint + script/lint

#55 opened 2026-08-10 13:14:53 +02:00 by clawbot

script/cibuild can report a cached green: docker build serves RUN make check layers from cache

#54 opened 2026-08-09 07:38:10 +02:00 by clawbot 1.0.0

Test suite cannot meet the 20s policy budget once -race is enabled: internal/cli 100MB boundary tests

#52 opened 2026-08-09 07:03:09 +02:00 by clawbot 1.0.0

checkUnlockerExists fails open: an unenumerable unlockers.d reports "no duplicate" and permits a duplicate unlocker

#51 opened 2026-08-09 04:25:11 +02:00 by clawbot 1.0.0

Darwin-only code is never compiled, linted, or tested by CI, including both hardware-backed unlockers

#50 opened 2026-08-09 03:46:49 +02:00 by clawbot 1.0.0

Tests assert on error message fragments, never on sentinel identity — error-handling regressions pass silently

#49 opened 2026-08-09 03:46:20 +02:00 by clawbot 1.0.0

CreatePGPUnlocker leaves a partial unlocker directory on disk when fingerprint resolution fails

#48 opened 2026-08-09 03:44:00 +02:00 by clawbot 1.0.0

Error messages leak internals and offer no recovery path for corrupted key files

#47 opened 2026-08-09 03:43:37 +02:00 by clawbot 1.0.0

README missing four required sections; TODO.md is stale and describes completed work as pending

#46 opened 2026-08-09 03:43:16 +02:00 by clawbot 1.0.0

Makefile hardcodes a personal remote DOCKER_HOST, breaking make docker for everyone else

#44 opened 2026-08-09 03:42:32 +02:00 by clawbot 1.0.0

Go module path is git.eeqj.de/sneak/secret, policy requires sneak.berlin/go/secret

#43 opened 2026-08-09 03:42:14 +02:00 by clawbot 1.0.0

PGPUnlocker.GetID panics on corrupt metadata, and setMnemonicEnv re-exports the mnemonic

#42 opened 2026-08-09 03:41:58 +02:00 by clawbot 1.0.0

Cobra prints full usage on internal failures, burying the actual error

#41 opened 2026-08-09 03:41:34 +02:00 by clawbot 1.0.0

.gitignore does not exclude secrets, and .dockerignore does not exclude .git

#40 opened 2026-08-09 03:41:08 +02:00 by clawbot 1.0.0

No confirmation prompt on any destructive operation

#39 opened 2026-08-09 03:40:49 +02:00 by clawbot 1.0.0

age identity .String() creates unprotected copies of private keys at six call sites

#38 opened 2026-08-09 03:40:29 +02:00 by clawbot 1.0.0

GetSecretVersion copies decrypted secrets out of locked memory into plain []byte

#37 opened 2026-08-09 03:40:04 +02:00 by clawbot 1.0.0

KeychainData holds the age key passphrase as a plain string through JSON marshalling

#36 opened 2026-08-09 03:39:45 +02:00 by clawbot 1.0.0

memguard lifecycle is not wired up: Ctrl-C and error exits leave key material in locked memory unwiped

#35 opened 2026-08-09 03:39:22 +02:00 by clawbot 1.0.0

No file locking and no atomic writes: concurrent or interrupted operations corrupt the vault

#34 opened 2026-08-09 03:38:51 +02:00 by clawbot 1.0.0

1 2