Rotate what was exposed on 2026-11-07 #134

New Issue

2026-11-07T20:15:18Z

rajames commented

2026-11-07 20:15:18 +00:00

Found

During the 2026-11-07 session these went through chat, and some over plain HTTP (the issue above):

the Gitea password of rajames (pasted in chat; used over plain HTTP for API calls and pushes)
the Nexus admin password (pasted; Captain Bob: "I will change it")
the Nexus snapshot-admin password (pasted; for #129)
the access tokens claude-session-20261106 (#109) and ci-packages (made in the session; its value is the secret PACKAGES_TOKEN)
a passphrase to an encrypted tarball (already rotated)

Done when

rajames's Gitea password changed, after the HTTPS redirect is in
Nexus admin changed; snapshot-admin deleted once #129's Nexus part is done
claude-session-20261106 revoked (#109); ci-packages replaced by a new token in PACKAGES_TOKEN, then revoked
Passwords and tokens given to a session by a credential form or an environment secret, not pasted

🤖 Filed with Claude Code -- the review after v4.0.0-alpha.3 (Captain Bob, 2026-11-07: "a list of problems, deficiencies, smells and so on placed in issues by rank priority").

### Found During the 2026-11-07 session these went through chat, and some over plain HTTP (the issue above): - the Gitea password of `rajames` (pasted in chat; used over plain HTTP for API calls and pushes) - the Nexus `admin` password (pasted; Captain Bob: "I will change it") - the Nexus `snapshot-admin` password (pasted; for #129) - the access tokens `claude-session-20261106` (#109) and `ci-packages` (made in the session; its value is the secret `PACKAGES_TOKEN`) - a passphrase to an encrypted tarball (already rotated) ### Done when - [ ] `rajames`'s Gitea password changed, after the HTTPS redirect is in - [ ] Nexus `admin` changed; `snapshot-admin` deleted once #129's Nexus part is done - [ ] `claude-session-20261106` revoked (#109); `ci-packages` replaced by a new token in `PACKAGES_TOKEN`, then revoked - [ ] Passwords and tokens given to a session by a credential form or an environment secret, not pasted 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- the review after v4.0.0-alpha.3 (Captain Bob, 2026-11-07: "a list of problems, deficiencies, smells and so on placed in issues by rank priority").

rajames added this to the v4.0.0-alpha.4 milestone 2026-11-07 20:15:18 +00:00

rajames added the

labels 2026-11-07 20:15:18 +00:00

rajames referenced this issue

2026-11-07 20:16:16 +00:00

alpha.4: the list #147