17 lines
1.2 KiB
Plaintext
17 lines
1.2 KiB
Plaintext
# Known historical findings, reviewed 2026-07-06 — all benign, baselined so CI stays strict
|
|
# on anything NEW. Format: <commit>:<file>:<rule>:<line>.
|
|
#
|
|
# 1-3) scratchpad QA probe scripts embed the Firebase WEB API key (AIzaSyDAD7…). That key is
|
|
# a project identifier, not a bearer secret (access control = Auth + rules + App Check),
|
|
# and it ships inside every APK anyway. Owner hardening (optional): add application
|
|
# restrictions to the key in GCP Console → Credentials.
|
|
62696a69ea2de499b3b28204bdb4e0ffa9fdfe25:scratchpad/rules_arrays.js:gcp-api-key:8
|
|
62696a69ea2de499b3b28204bdb4e0ffa9fdfe25:scratchpad/rules_pos.js:gcp-api-key:3
|
|
38ff166598d6d85145bbeea53e651f7ef0cbc9f6:scratchpad/d3_negative.js:gcp-api-key:6
|
|
#
|
|
# 4-6) iOS crypto unit-test fixtures — fixed base64 test vectors (e.g. "test-keybox-
|
|
# ciphertext-blob"), not credentials.
|
|
ade4667db723986c2d0185cfa71aa7808d559a8b:iphone/CloserTests/CryptoTests/KeyboxCallableTests.swift:generic-api-key:44
|
|
ade4667db723986c2d0185cfa71aa7808d559a8b:iphone/CloserTests/CryptoTests/KeyboxCallableTests.swift:generic-api-key:73
|
|
60c0003114fe0677858b0b2de7331a2a3699f901:iphone/CloserTests/CryptoTests/AES_GCM_KnownVectorTests.swift:generic-api-key:37
|