Ensure AUTH token is only read from env; never persist to state, manifest, or systemd unit files.
Add a lightweight lint/check (pre-commit or CI) that fails if PIKIT_AUTH_TOKEN or similar patterns appear in tracked files (manifests, systemd units, code).
Document how to inject tokens via systemd drop-in or runtime env without committing them.
Acceptance
No tokens are written to state or logs.
Lint fails when secrets are committed.
Docs clarify the safe way to provide tokens.
Proposal
- Ensure AUTH token is only read from env; never persist to state, manifest, or systemd unit files.
- Add a lightweight lint/check (pre-commit or CI) that fails if PIKIT_AUTH_TOKEN or similar patterns appear in tracked files (manifests, systemd units, code).
- Document how to inject tokens via systemd drop-in or runtime env without committing them.
Acceptance
- No tokens are written to state or logs.
- Lint fails when secrets are committed.
- Docs clarify the safe way to provide tokens.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Proposal
Acceptance