Commits
-
gitleaks: keep allowing the old owner-subject test's made-up key (the full-history scan still reads it) (#38)OpenVibers · 5 Oct 2026
a82e1be -
X-Internal-Key is gone from Media (plan T2, the last step): POST /internal/avatar-ingest takes only a Network service token holding media.avatar.ingest, loopback only; guardOrKey, config.network.internalApiKey and INTERNAL_API_KEY are deleted (production no longer sets it), and the visitor-hash secret is VIEW_HASH_SECRET or MEDIA_SECRET with a named warning when neither is set in production. Tests: token with the capability passes, without it 403, wrong audience and sandbox 401, no credential or a forged Bearer refused. npm test and test:pg 75/76, 1 skipped (verified).OpenVibers · 29 Sept 2026
809b06b -
gitleaks: allow the owner-subject test's made-up INTERNAL_API_KEY, matched on path and valueOpenVibers · 23 Sept 2026
ce6a02a -
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026
454dc09