fix(security): remove hardcoded Qdrant key + allowlist doc false-positives

secret-scan (gitleaks) had never run on a PR (broken checkout). A real Qdrant dev API key was hardcoded in 4 pre-existing files; removed in favour of env / gitea-secret references (scripts read QDRANT_API_KEY from os.environ; rag-ingest workflow references a gitea Actions secret). The remaining ~52 findings are doc curl examples + .env.example placeholders + a rule_key identifier, allowlisted in .gitleaks.toml (default ruleset kept). gitleaks now reports 0 findings. ACTION REQUIRED: rotate the Qdrant dev API key — the leaked value is in git history. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-21 14:37:54 +02:00
parent 079bb56922
commit 5f8009e844
5 changed files with 28 additions and 4 deletions
@@ -74,7 +74,7 @@ jobs:
            -e "WORK_DIR=/tmp/rag-ingestion" \
            -e "RAG_URL=http://bp-core-rag-service:8097/api/v1/documents/upload" \
            -e "QDRANT_URL=https://qdrant-dev.breakpilot.ai" \
-            -e "QDRANT_API_KEY=z9cKbT74vl1aKPD1QGIlKWfET47VH93u" \
+            -e "QDRANT_API_KEY=${{ secrets.QDRANT_API_KEY }}" \
            -e "SDK_URL=http://bp-compliance-ai-sdk:8090" \
            alpine:3.19 \
            sh -c "