1.0.0

New Issue

Blockers for tagging v1.0.0. Security-critical correctness and memory-hygiene work in a secrets-handling tool, plus org code-standard compliance. Nothing here is optional for the 1.0 tag.

No due date

15% Completed

script/cibuild can report a cached green: docker build serves RUN make check layers from cache

#54 opened 2026-08-09 07:38:10 +02:00 by clawbot

Make script/test fail on flaky failures and enable -race (closes #32)

check / check (push) Failing after 1m45s

Details

needs-checks

#53 opened 2026-08-09 07:04:25 +02:00 by clawbot

fix-script-test-race

1 conflicting file

Test suite cannot meet the 20s policy budget once -race is enabled: internal/cli 100MB boundary tests

#52 opened 2026-08-09 07:03:09 +02:00 by clawbot

checkUnlockerExists fails open: an unenumerable unlockers.d reports "no duplicate" and permits a duplicate unlocker

#51 opened 2026-08-09 04:25:11 +02:00 by clawbot

Darwin-only code is never compiled, linted, or tested by CI, including both hardware-backed unlockers

#50 opened 2026-08-09 03:46:49 +02:00 by clawbot

Tests assert on error message fragments, never on sentinel identity — error-handling regressions pass silently

#49 opened 2026-08-09 03:46:20 +02:00 by clawbot

CreatePGPUnlocker leaves a partial unlocker directory on disk when fingerprint resolution fails

#48 opened 2026-08-09 03:44:00 +02:00 by clawbot

Error messages leak internals and offer no recovery path for corrupted key files

#47 opened 2026-08-09 03:43:37 +02:00 by clawbot

README missing four required sections; TODO.md is stale and describes completed work as pending

#46 opened 2026-08-09 03:43:16 +02:00 by clawbot

Makefile hardcodes a personal remote DOCKER_HOST, breaking make docker for everyone else

#44 opened 2026-08-09 03:42:32 +02:00 by clawbot

Go module path is git.eeqj.de/sneak/secret, policy requires sneak.berlin/go/secret

#43 opened 2026-08-09 03:42:14 +02:00 by clawbot

PGPUnlocker.GetID panics on corrupt metadata, and setMnemonicEnv re-exports the mnemonic

#42 opened 2026-08-09 03:41:58 +02:00 by clawbot

Cobra prints full usage on internal failures, burying the actual error

#41 opened 2026-08-09 03:41:34 +02:00 by clawbot

.gitignore does not exclude secrets, and .dockerignore does not exclude .git

#40 opened 2026-08-09 03:41:08 +02:00 by clawbot

No confirmation prompt on any destructive operation

#39 opened 2026-08-09 03:40:49 +02:00 by clawbot

age identity .String() creates unprotected copies of private keys at six call sites

#38 opened 2026-08-09 03:40:29 +02:00 by clawbot

GetSecretVersion copies decrypted secrets out of locked memory into plain []byte

#37 opened 2026-08-09 03:40:04 +02:00 by clawbot

KeychainData holds the age key passphrase as a plain string through JSON marshalling

#36 opened 2026-08-09 03:39:45 +02:00 by clawbot

memguard lifecycle is not wired up: Ctrl-C and error exits leave key material in locked memory unwiped

#35 opened 2026-08-09 03:39:22 +02:00 by clawbot

No file locking and no atomic writes: concurrent or interrupted operations corrupt the vault

#34 opened 2026-08-09 03:38:51 +02:00 by clawbot

1 2