Contracts fixture: no secret-shaped placeholder (secret scanning alert #2, a false positive) (#91)

OP OpenVibers committed 11 Oct 2026 · 1987826887 · 1 file, +2 −3

GitHub secret scanning flagged `fixtures/actor.task-webhook/invalid/carries-secret.json:41` (alert #2, "Stripe Webhook Signing Secret").

- **A false positive:** the value was `whsec_` followed by 43 `A`s, a placeholder written for the fixture in #86. It is not a key anyone issued, so nothing needs rotating. It matched only because Actor's per-task webhook secrets (like Events' subscription secrets) use the `whsec_` prefix that Stripe also uses.
- **Fix:** the fixture no longer carries a secret-shaped string. It stays invalid for the reason it exists: a delivery body has no field for a secret, so its top-level `secret` is refused (additionalProperties false).
- **Contracts sweep:** no other `whsec_`-shaped literal is left in fixtures, contracts, docs or lib.
- **The org:** this was the only open secret-scanning alert across the OpenVibers repositories (checked repo by repo). The alert is resolved as `used_in_tests`.

`node test/run.js`: 18,420 checks passed.

Changes

ddiff --git a/fixtures/actor.task-webhook/invalid/carries-secret.json b/fixtures/actor.task-webhook/invalid/carries-secret.json
iindex 6ee30c6f..deb777f1 100644
---- a/fixtures/actor.task-webhook/invalid/carries-secret.json
++++ b/fixtures/actor.task-webhook/invalid/carries-secret.json
@@@ -37,8 +37,7 @@
            "failed"
          ]
        }
--    ],
--    "webhook_secret": "whsec_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
++    ]
    },
--  "secret": "x"
++  "secret": "not-a-secret: a delivery body has no field for one"
  }