From 5db3083696006ef2962cacbf0fd59003282e17c5 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sat, 22 Aug 2026 20:44:48 -0700 Subject: [PATCH] Stop committing the alerting-evaluator service password reset-demo.sh carried EVALUATOR_PASSWORD as a literal, which put a working service-account password in the repository. Anyone who could read the source could log in as alerting-evaluator against the live demo and mint an ALERTING_SERVICE_TOKEN whenever they liked -- so rotating the token was theatre while the password that mints it stayed published. Nothing needed it to be a constant. The account exists only to mint that token a few lines later, and `docker compose down -v` earlier in the same script has already destroyed the previous account, so the value never outlives a single reset. Generated per run instead. DEMO_PASSWORD directly above is deliberately left alone: it is a public demo credential, prefilled on the login page and baked into the web bundle at build time from the demo host's compose override. Randomising it would break the demo's own login form, and it protects nothing. --- hack/demo-seed/reset-demo.sh | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/hack/demo-seed/reset-demo.sh b/hack/demo-seed/reset-demo.sh index a3e89f0..b34af0e 100755 --- a/hack/demo-seed/reset-demo.sh +++ b/hack/demo-seed/reset-demo.sh @@ -33,7 +33,20 @@ ADMIN_PASSWORD_FILE="$DEMO_ROOT/.admin-password" # demo host's docker-compose.override.yml. Change one without the other # and the demo's own login form stops working. DEMO_PASSWORD='CairnDemo_2026!' -EVALUATOR_PASSWORD='REDACTED_ROTATED_CREDENTIAL' +# Generated fresh every run, never committed. This account exists only +# to mint the ALERTING_SERVICE_TOKEN a few lines below, and `docker +# compose down -v` above has already destroyed the previous one, so the +# value never needs to outlive a single reset -- there is nothing to +# remember and therefore no reason to hardcode it. It used to be a +# literal in this file, which put a working service-account password in +# the repo: anyone who could read the source could mint an +# alerting-evaluator token against the live demo at will, and rotating +# the token achieved nothing while the password that mints it stayed +# published. +# +# Unlike DEMO_PASSWORD above, this one is never shown to a user and is +# not baked into the web bundle, so randomising it breaks nothing. +EVALUATOR_PASSWORD="$(openssl rand -base64 24)" echo "=== $(date -u +%FT%TZ) reset starting ==="