amadan
docs: secrets.md — the GitHub sign-in client secret (#1167)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+6
−0
docs/secrets.md+6 −0
diff --git a/docs/secrets.md b/docs/secrets.md| index bfbcfbb..94f350b 100644 |
| --- a/docs/secrets.md |
| +++ b/docs/secrets.md |
| @@ -66,6 +66,12 @@ private — is `docs/secrets-vault.md`. |
| send mail as the sign-in address (phishing paper). *Rotate*: standard IAM |
| two-key rotation. Note it shares the `AWS_*` env with the S3 store below — |
| an instance running both needs one IAM user carrying both scopes. |
| +- **GitHub OAuth client secret** (`LCHAT_HOME_GITHUB_CLIENT_SECRET`) — the |
| + one sign-in door whose exchange home runs itself (github.go; the OIDC |
| + providers verify id_tokens and need no secret). *Blast radius*: initiate |
| + GitHub OAuth flows as the Eleven app — no stored user material to read. |
| + *Rotate*: regenerate at the GitHub OAuth app, swap the env, restart; the |
| + per-provider pepper (covered above) is untouched. |
| - **S3 backend credentials** (`AWS_*` when `LCHAT_HOME_STORE=s3`) — object |
| access to the home bucket. *Blast radius*: read/overwrite vault ciphertext |
| and WebAuthn public credentials; versioning keeps the last 5, so vandalism |