Skip to content

SECURITY_CHECKLIST.md

Latest commit

 

History

History
273 lines (206 loc) · 7.28 KB

SECURITY_CHECKLIST.md

File metadata and controls

273 lines (206 loc) · 7.28 KB

Security Checklist - Pre-Release Verification

This checklist ensures no sensitive information is committed to the public repository.

✅ Completed Security Measures

Personal Information Removed

  • Username "nativeapps" removed from all documentation
  • Absolute paths /Users/nativeapps/ removed from docs
  • Personal directory paths sanitized
  • Author information generalized to "ProxyMe Contributors"

Sensitive Files Removed

  • All script.py and script_*.py files deleted
  • Build logs (build.log, build-jdk17.log) deleted
  • Helper scripts (proxy-helper.sh) removed
  • Internal session notes deleted
  • Development markdown files removed
  • Old versioned documentation cleaned up

Configuration Files Secured

  • .env files listed in .gitignore
  • API keys never hardcoded
  • No example .env with real keys
  • Keys stored in user home directory (~/.proxyme/)
  • .env files excluded from git
  • Proper file permissions documented (600 for .env)

Repository References Updated

  • Old repository URLs removed
  • GitHub URLs updated to native-apps/proxyme
  • Package.json files updated
  • CHANGELOG.md links updated
  • Documentation links corrected

.gitignore Comprehensive

  • .env and environment files
  • API keys and secrets patterns
  • Build artifacts (except release/)
  • Log files
  • OS-specific files
  • IDE configuration files
  • Personal notes and temp files
  • User data directories

🔍 Verification Commands

Run these commands to verify no sensitive data remains:

Check for Usernames

grep -r "nativeapps" . --include="*.md" --include="*.java" --include="*.kt" --exclude-dir=".git" --exclude-dir="docs/archive" --exclude-dir="build"
# Should return NO results (except in archive docs which is OK)

Check for Absolute Paths

grep -r "/Users/nativeapps" . --include="*.md" --include="*.java" --include="*.kt" --exclude-dir=".git" --exclude-dir="docs/archive" --exclude-dir="build"
# Should return NO results (except in archive docs which is OK)

Check for API Keys (Patterns)

grep -rE "(sk-[a-zA-Z0-9]{20,}|pplx-[a-zA-Z0-9]{20,}|sk-ant-[a-zA-Z0-9]{20,})" . --exclude-dir=".git" --exclude-dir="node_modules" --exclude-dir="build"
# Should return NO results

Check for Email Addresses

grep -rE "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" . --include="*.md" --include="*.java" --exclude-dir=".git" --exclude-dir="node_modules"
# Review any results - should be generic or intentional

Check .gitignore Effectiveness

git status --ignored
# Review ignored files - should include .env, logs, etc.

Verify No Sensitive Files Staged

git diff --cached --name-only | xargs -I {} sh -c 'echo "=== {} ===" && cat {}'
# Review all staged files manually

📋 Documentation Review

Verify these files contain NO sensitive information:

  • README.md
  • INSTALL.md
  • BUILD.md
  • CONTRIBUTING.md
  • TROUBLESHOOTING.md
  • CHANGELOG.md
  • ROADMAP.md
  • LICENSE
  • docs/**/*.md (except archive)

Specific Checks

# Check each major file
for file in README.md INSTALL.md BUILD.md CONTRIBUTING.md TROUBLESHOOTING.md; do
  echo "=== Checking $file ==="
  grep -i "nativeapps\|/Users/\|api.*key.*=\|password\|secret" "$file" || echo "✓ Clean"
done

🔐 API Key Storage Verification

Ensure proper API key handling:

  • Keys stored in ~/.proxyme/proxy/.env
  • Never in project directory
  • Never in version control
  • Documented as user-provided
  • Template files use placeholders only
  • UI masks API keys in display

Verify .env Template

cat "Node.js Proxy Cloud AI APIs/.env.template" 2>/dev/null || cat "src/main/resources/proxy/.env.template" 2>/dev/null
# Should contain ONLY placeholders like: DEEPSEEK_API_KEY=your-key-here

🗂️ File Structure Verification

Ensure no sensitive directories are included:

# List all committed files
git ls-tree -r HEAD --name-only | head -50

# Should NOT include:
# - Personal directories
# - .env files
# - Log files with real data
# - API key files
# - Backup files with sensitive data

🧪 Test Clone Verification

Perform a test clone to verify security:

# Clone to temporary directory
cd /tmp
git clone /path/to/ProxyMe proxyme-test
cd proxyme-test

# Verify no sensitive files
find . -name "*.env" -o -name "*secret*" -o -name "*key*" -type f
# Should return ONLY .env.template or .gitignore references

# Check for absolute paths
grep -r "/Users/" . --exclude-dir=".git" --exclude-dir="docs/archive"
# Should return NO results (except archive)

# Cleanup
cd ..
rm -rf proxyme-test

🚨 Red Flags to Watch For

Immediately remove if found:

  • ❌ Real API keys (sk-..., pplx-..., sk-ant-...)
  • ❌ Passwords or credentials
  • ❌ Personal email addresses (except generic/public)
  • ❌ Absolute file paths with usernames
  • ❌ Private repository URLs
  • ❌ Internal company/project names
  • ❌ Development machine hostnames
  • ❌ IP addresses (except localhost/127.0.0.1)
  • ❌ Database connection strings
  • ❌ SSH keys or certificates

✅ Pre-Push Final Check

Before pushing to GitHub, verify:

# Check git log for sensitive commit messages
git log --oneline | grep -i "password\|secret\|key\|private"
# Should be empty or reviewed

# Check all tracked files
git ls-files | wc -l
# Should be reasonable number (not including sensitive files)

# Verify .gitignore is working
git status --ignored | grep -i "\.env\|\.log"
# Should show these as ignored

# Final scan
git grep -i "password\|secret\|private.*key" -- '*.md' '*.java' '*.kt' '*.json'
# Review all results - should be documentation only

📝 Sign-Off

Before deploying to GitHub, confirm:

  • Ran all verification commands above
  • Reviewed flagged items
  • No real API keys found
  • No personal paths found
  • No sensitive usernames found
  • .gitignore is comprehensive
  • Documentation is clean
  • Test clone performed successfully
  • All red flags addressed

Signed off by: ___________________
Date: ___________________

🆘 If Sensitive Data Found

If you discover sensitive information after pushing to GitHub:

  1. DO NOT just delete the file - Git history still contains it
  2. Rotate any exposed credentials immediately
  3. Use git-filter-repo or BFG Repo-Cleaner to remove from history
  4. Force push the cleaned history
  5. Notify anyone who cloned the repository

Quick Cleanup Command

# Install git-filter-repo
brew install git-filter-repo  # macOS
# or: pip install git-filter-repo

# Remove sensitive file from entire history
git filter-repo --path path/to/sensitive/file --invert-paths

# Force push
git push origin --force --all

📚 Additional Resources

Remember: Once pushed to GitHub, assume data is public forever. Better to be overly cautious!