tiennm99/bsk - bsk - Gitea: Git with a cup of tea

tiennm99/bsk

Fork 0

mirror of https://github.com/tiennm99/bsk.git synced 2026-07-13 11:06:40 +00:00

Commit Graph

Author	SHA1	Message	Date
tiennm99	eeda68c34a	chore(ci): add NEXT_PUBLIC_=sb_secret_ leak guard Defense-in-depth check that fails the build (and the local pre-push workflow) if a server secret value is assigned to a NEXT_PUBLIC_* variable — those get bundled into the browser by Next.js. - scripts/check-no-secret-leak.mjs: git grep for the assignment shape, excluding lockfiles and the script itself - package.json: pnpm check:no-secret-leak - .github/workflows/ci.yml: run the guard right after install, before format/lint/typecheck/build - docs/threat-model.md: close the last Unresolved item	2026-05-25 16:19:43 +07:00
tiennm99	699686253c	docs: record phase-5/7 + key-rotation decisions - Phase 5 imaging: keep, pin numbers — 200 KB/image, 1h signed-URL TTL, 7-day retention window (PLAN.md §4 Phase 5) - Phase 7 reminders: keep QStash (free tier 1000 msgs/day covers clinic-scale); document signature + Zod + DB-invariant validation plan in threat-model R8 - sb_secret_* / sb_publishable_* rotation: event-driven only for the current educational scope (solo author, no real users); switch to quarterly when any real user exists - threat-model Unresolved: drop the three items above; CI grep for sb_secret_ in NEXT_PUBLIC_* lines remains the only open question	2026-05-25 16:16:38 +07:00
tiennm99	0393ddf6ec	docs(infra): add shared-supabase config, restore runbook, threat model, db preflight - docs/supabase-shared-config.md: registry of project-wide Supabase settings (auth, JWT, email, keys, storage, realtime) shared across sibling apps; change-coordination protocol - docs/runbooks/restore-from-bad-migration.md: per-schema recovery via pg_dump --schema=bsk that avoids project-wide PITR (which would also wipe sibling apps) - docs/threat-model.md: trust model, sibling-app invite-only policy (mitigates auth.users blast radius), R1-R8 residual risks, unresolved questions for Phase 1 - scripts/preflight-supabase.ts: refuses 'supabase db push' unless the linked project ref is in ALLOWED_PROJECT_REFS; wired via pnpm db:push - package.json: tsx devDep, db:preflight + db:push scripts - pnpm-workspace.yaml: allowBuilds esbuild=true (required for tsx)	2026-05-25 15:57:10 +07:00

Author

SHA1

Message

Date

tiennm99

eeda68c34a

chore(ci): add NEXT_PUBLIC_*=sb_secret_* leak guard

Defense-in-depth check that fails the build (and the local pre-push
workflow) if a server secret value is assigned to a NEXT_PUBLIC_*
variable — those get bundled into the browser by Next.js.

- scripts/check-no-secret-leak.mjs: git grep for the assignment shape,
  excluding lockfiles and the script itself
- package.json: pnpm check:no-secret-leak
- .github/workflows/ci.yml: run the guard right after install, before
  format/lint/typecheck/build
- docs/threat-model.md: close the last Unresolved item

2026-05-25 16:19:43 +07:00

tiennm99

699686253c

docs: record phase-5/7 + key-rotation decisions

- Phase 5 imaging: keep, pin numbers — 200 KB/image, 1h signed-URL TTL,
  7-day retention window (PLAN.md §4 Phase 5)
- Phase 7 reminders: keep QStash (free tier 1000 msgs/day covers
  clinic-scale); document signature + Zod + DB-invariant validation
  plan in threat-model R8
- sb_secret_* / sb_publishable_* rotation: event-driven only for the
  current educational scope (solo author, no real users); switch to
  quarterly when any real user exists
- threat-model Unresolved: drop the three items above; CI grep for
  sb_secret_ in NEXT_PUBLIC_* lines remains the only open question

2026-05-25 16:16:38 +07:00

tiennm99

0393ddf6ec

docs(infra): add shared-supabase config, restore runbook, threat model, db preflight

- docs/supabase-shared-config.md: registry of project-wide Supabase
  settings (auth, JWT, email, keys, storage, realtime) shared across
  sibling apps; change-coordination protocol
- docs/runbooks/restore-from-bad-migration.md: per-schema recovery via
  pg_dump --schema=bsk that avoids project-wide PITR (which would also
  wipe sibling apps)
- docs/threat-model.md: trust model, sibling-app invite-only policy
  (mitigates auth.users blast radius), R1-R8 residual risks, unresolved
  questions for Phase 1
- scripts/preflight-supabase.ts: refuses 'supabase db push' unless the
  linked project ref is in ALLOWED_PROJECT_REFS; wired via pnpm db:push
- package.json: tsx devDep, db:preflight + db:push scripts
- pnpm-workspace.yaml: allowBuilds esbuild=true (required for tsx)

2026-05-25 15:57:10 +07:00

3 Commits