FactorAI
Demo ModeExit demoStart free
Ready
You
Triage this morning's secret-scanning alerts.
Assistant

Two new GitHub secret-scanning alerts this morning:

  • A revoked Slack webhook in docs/examples (no action beyond removal).
  • A live staging Postgres URL in scripts/seed.ts: rotate today.

I opened SEC-91 for the rotation.

You
How long has the staging URL been in the repo?
Assistant

The Postgres URL was committed 9 days ago and the repo has 14 contributors, so I treat it as exposed. It points to staging only; no production credentials appear in the history.

You
Was it used by anyone outside our network?
Assistant

Staging logs show no connections from unknown IPs since the commit. Rotation is still required, but there is no sign of misuse.

You
What are the rotation steps?
Assistant

Steps for SEC-91:

  1. Rotate the staging DB password in the secrets manager.
  2. Redeploy staging services.
  3. Replace the URL in scripts/seed.ts with process.env.SEED_DATABASE_URL.
  4. Purge the old value from git history if the team agrees.