fix(security): remove hardcoded Qdrant key + allowlist doc false-positives

secret-scan (gitleaks) had never run on a PR (broken checkout). A real Qdrant dev API key was hardcoded in 4 pre-existing files; removed in favour of env / gitea-secret references (scripts read QDRANT_API_KEY from os.environ; rag-ingest workflow references a gitea Actions secret). The remaining ~52 findings are doc curl examples + .env.example placeholders + a rule_key identifier, allowlisted in .gitleaks.toml (default ruleset kept). gitleaks now reports 0 findings. ACTION REQUIRED: rotate the Qdrant dev API key — the leaked value is in git history. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-21 14:37:54 +02:00
parent 079bb56922
commit 5f8009e844
5 changed files with 28 additions and 4 deletions
@@ -1,8 +1,9 @@
 """Delete eu_2023_988 duplicate from production Qdrant."""
 import httpx
+import os

 PROD_URL = "https://qdrant-dev.breakpilot.ai"
-HEADERS = {"api-key": "z9cKbT74vl1aKPD1QGIlKWfET47VH93u"}
+HEADERS = {"api-key": os.environ.get("QDRANT_API_KEY", "")}

 # Delete
 resp = httpx.post(