From a4e2038aac6475c722ce20d1e2fbc771a20a899b Mon Sep 17 00:00:00 2001 From: Satoshi Qazi Muhammed Date: Wed, 8 Jul 2026 09:46:58 -0700 Subject: [PATCH 1/2] fix: exclude "account" field from hardcoded-private-key scan (false positive) Every account_overrides.json/chains_for_testBalance.json entry has a 32-byte hex "account" field - a public AccountId32 (Substrate's public account identifier), not a private key. The two share the same byte length/hex format, but are fundamentally different: one is meant to be public (it's literally how you address a chain account), the other must stay secret. The scanner's regex can't tell them apart and flags every single one, which just triggered a false "Possible private key found" failure on PR #33 (the master->main sync). This isn't a one-off - it'll fire on every future sync PR too, since chains_for_testBalance.json always has these fields. Left as "FAILURE" long-term, it trains reviewers to ignore this specific check, which is exactly the alarm-fatigue failure mode that would let a real leaked secret slip through unnoticed. --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d15ace6..f97fb1e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -60,7 +60,7 @@ jobs: FOUND=0 echo "Checking for private keys in config files..." - if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions"; then + if grep -rn --include="*.json" --include="*.py" -E "(0x[a-fA-F0-9]{64}|-----BEGIN.*PRIVATE)" . | grep -v node_modules | grep -v "chainId\|genesisHash\|parentId\|currencyIdScale\|typeAlias\|signedExtensions\|\"account\""; then echo "::error::Possible private key found" FOUND=1 fi From 7a89c902a8c42dd837efd028b444fd8a5e16a641 Mon Sep 17 00:00:00 2001 From: Satoshi Qazi Muhammed Date: Wed, 8 Jul 2026 10:09:17 -0700 Subject: [PATCH 2/2] chore: retrigger CI (action_required gate again)