ff0d0dde61
tools/ci/founder-strings.b64 was the founder check's pattern list base64-encoded: a grep could not read it, any reader of the public host could (git.igneum.network was public from 21:26 UK; read off at 21:36). The list now lives only in a private file (~/.config/igneum/founder-strings on the Mac, /srv/discord-hooks/founder-strings on build-1 for the Discord guard; $IGNEUM_FOUNDER_STRINGS overrides) and site/forbidden-strings.txt carries no encoded copy. Readers: founder-strings-check.sh (skips with a line where the file is absent; the Mac's hook is the guard), site/scrub.mjs and launch-gates-check.mjs (the private file's patterns added where it exists), discord-hooks.mjs (three locations; the test writes a fixture list and loads the module after it), fresh-repo.sh (the private file; drops tools/ci/founder-strings.b64 from every commit; rewrites the base64 of every list regex out of every blob and scans for it). The check's second pass (main's addition): every base64 literal of 24 characters or more, every hex literal of 24 or more and every *.b64 file is decoded and scanned, so no encoding hides a term again; the self-test plants each fixture sample in plain text, in a .b64 file, as a base64 literal and as a hex literal, each caught and named, and a tree without the list skips with its line. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
40 lines
1.5 KiB
Text
40 lines
1.5 KiB
Text
DESKTOP-[A-Z0-9]{7}
|
|
MacBook
|
|
192\.168\.
|
|
100\.[0-9]+\.[0-9]+\.[0-9]+
|
|
\+0100
|
|
\bBST\b
|
|
/Users/
|
|
C:\\Users
|
|
~/Desktop
|
|
log-intake
|
|
LOG_INTAKE
|
|
intake[_-]?key
|
|
Tailscale
|
|
tailscale
|
|
ts\.net
|
|
# the founder's name, logins and the earlier businesses are NOT in this file in any encoding (a base64 line is a disclosure to any reader, found
|
|
# 7 October 2026, 21:3x UK, on the public host): they live in the private list ~/.config/igneum/founder-strings, read by site/scrub.mjs,
|
|
# tools/ci/launch-gates-check.mjs and tools/ci/founder-strings-check.sh where it exists; the Mac's pre-push hook is the guard on every push.
|
|
Hetzner
|
|
igneum-seed
|
|
/root/
|
|
/opt/igneum
|
|
# a tokened downloads link (dl.igneum.network/dl/<token>/...); the public buttons use /public/ and /dl/public/ and are meant to be here
|
|
dl\.igneum\.network/dl/[A-Za-z0-9_-]{16,}/
|
|
intake id
|
|
CLAUDE\.md
|
|
DESKTOP-KMCV
|
|
\bhcloud\b
|
|
# 6 October 2026, site audit: the two Windows machines are described (site/scrub.mjs), never numbered
|
|
\bPC [12]\b
|
|
# the site audit's page-leak patterns, 6 October 2026: config paths, process ids, listen addresses, the node flag
|
|
~/\.config
|
|
\bpid [0-9]+\b
|
|
0\.0\.0\.0:[0-9]+
|
|
--rpclisten=
|
|
# the disclosure prize is approved but its announcement is staged until the entity address exists and the owner gives the publish word (cryptanalysis plan 3.3, 7 October 2026)
|
|
disclosure prize
|
|
# the rig names never reach a served page (verification lane, 7 October 2026: a substring grep read "PC 2" inside gRPC port numbers; this is the word-bounded check)
|
|
\bPC [12]\b
|
|
counsel is engaged
|