39b5c94553
The public /ledger page (site/ledger.html) carried ~/.config/igneum paths five times, "pid 33114", --rpclisten=0.0.0.0:26610, "PC 2" fifteen times, "the Mac" nineteen times and 202 repository file paths, because tools/ledger-page.mjs scrubbed with its own short list and never ran the forbidden-strings hard stop (found by the site audit of 6 October 2026, docs/plans/site-ui-3-audit.md). Now: the generator's scrub replaces every config or home-directory path with "a config file" or "a home-directory file", a pid with "the process", a listen flag or 0.0.0.0 address with its plain words, "PC 1" and "PC 2" with "the Windows machine", "the Mac" with "the Apple M5 Max" (the bench log's rule), and every repository file path with "a repository file"; the page's own source note names no path. After rendering, the page is grepped with tools/ci/forbidden-strings.txt plus the leak classes and the render exits 1 on a hit. The pattern list gains ~/.config, pid N, 0.0.0.0:port, PC 1 and PC 2 and --rpclisten=, and the identity grep now covers site/ledger.html (html added to its file types). Regenerated: 167 entries, 0 leaks, identity grep 0 hits over 231 files, link check 0 broken. Consequence per reader: the ledger keeps every criticism, status and answer; what a reader loses is the exact repository path of a fix, which meant nothing outside the private repository. Nothing else on the site changes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
24 lines
No EOL
1.2 KiB
Text
24 lines
No EOL
1.2 KiB
Text
# Patterns that must never appear in the public export (grep -E, one per line, # comments ignored).
|
|
# This is the committed, non-secret subset of the public mirror's identity list (igneum-public/tools/identity.local,
|
|
# which stays private because its remaining entries would themselves name what must stay out). Machine names, LAN
|
|
# and overlay addresses, home paths, local time zones and the log-intake key pattern. Never a key, never a name.
|
|
# Checked by tools/ci/identity-check.sh over the export list of igneum-public/tools/sync.sh after its generic scrub.
|
|
# Not forbidden (decision of 5 October 2026): the registered address of Igneum Labs LTD, Innovation One, Dubai International
|
|
# Financial Centre (DIFC). It is the one location that may appear in public text. The founder and the earlier entity stay in
|
|
# the private list.
|
|
DESKTOP-[A-Z0-9]{7}
|
|
MacBook
|
|
192\.168\.
|
|
100\.[0-9]+\.[0-9]+\.[0-9]+
|
|
\+0100
|
|
\bBST\b
|
|
/Users/
|
|
C:\\Users
|
|
~/Desktop
|
|
log-intake
|
|
LOG_INTAKE
|
|
intake[_-]?key
|
|
Tailscale
|
|
tailscale
|
|
ts\.net
|
|
\n# 6 October 2026, the public ledger page leak (site audit): config paths, process ids, listen addresses, machine names\n~/\\.config\n\\bpid [0-9]+\\b\n0\\.0\\.0\\.0:[0-9]+\n\\bPC [12]\\b\n--rpclisten=\n |