31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# WRNexusJS 0.7.0 R1 — Local environment audit boundary
|
|
|
|
## Problem
|
|
|
|
The security audit recursively scanned every file in the working directory. Local, ignored environment files such as `examples/basic-app/.env` and `.env.uat` therefore failed the release audit even though they were not tracked by Git and would not be published.
|
|
|
|
## Fix
|
|
|
|
- Release security checks now scan `git ls-files -z` when Git metadata is available.
|
|
- Secret-like files tracked by Git still fail with `SEC-NO-TRACKED-SECRET-FILES`.
|
|
- Ignored or untracked local secret files produce `SEC-LOCAL-SECRET-FILES` warnings only.
|
|
- Source archives without `.git` metadata still scan every included file.
|
|
- The JSON report schema is updated to version 2 and includes warnings separately from errors.
|
|
|
|
## Existing repositories
|
|
|
|
If old `.env` files are still tracked, remove them from the Git index while retaining local copies:
|
|
|
|
```powershell
|
|
git rm --cached examples/basic-app/.env examples/basic-app/.env.uat
|
|
git add examples/basic-app/.env.example examples/basic-app/.env.uat.example .gitignore
|
|
git commit -m "security(examples): stop tracking local environment files"
|
|
```
|
|
|
|
The root `.gitignore` now also explicitly allows environment templates for named environments:
|
|
|
|
```gitignore
|
|
!.env.example
|
|
!.env.*.example
|
|
```
|