shcherbak-ai/omerta

Review signals: 2 hardcoded secret, 5 known vulnerability. 9 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Gitleaks found a possible hardcoded secret; value withheld. .github/workflows/publish.yml 2 findings.

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 5 findings.

9 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• check --all reports a value from .env that is committed in a tracked file, naming the variable and never the value: Real input produced the expected result: src/client.py:2: OPENAI_API_KEY (from .env)

  Source: **Values** come from `.env` and `.env.*` at the root that git does not track.

  Input: demo repo with .env OPENAI_API_KEY and the same value in tracked src/client.py

  Expected: finding names OPENAI_API_KEY (from .env) at src/client.py:2, exit 1

  Command: uvx omerta -C <guest-path> check --all

  Observed: src/client.py:2: OPENAI_API_KEY (from .env)

• exit code is 1 when a finding is made: Real input produced the expected result: src/client.py: OPENAI_API_KEY (from .env)

  Source: The exit code is `0` when nothing is found, `1` when something is, and `2` on an error.

  Input: same demo repo, history command

  Expected: history finding for OPENAI_API_KEY, exit 1

  Command: uvx omerta -C <guest-path> history

  Observed: src/client.py: OPENAI_API_KEY (from .env)

Examples

• quick start: scan every tracked file of the pinned repo (no env files, clean): command completed successfully with no output

  Source: README.md

  Input: omerta check --all in the pinned checkout

  Expected: no findings, exit 0

  Command: uvx omerta check --all

• quick start: history scan every commit, tag and message: command completed successfully with no output

  Source: README.md

  Input: omerta history in the pinned checkout

  Expected: no findings, exit 0

  Command: uvx omerta history

• repo's documented test command (CONTRIBUTING.md): command completed successfully

  Source: CONTRIBUTING.md

  Input: uv run pytest

  Expected: 237 passed, exit 0

  Command: uv run --no-progress pytest -q -p no:cacheprovider

  Observed: ........................................................................ [ 30%] ........................................................................ [ 60%] ........................................................................ [ 91%] ..................... [100%] 237 passed in 70.21s (0:01:10)

Local or hosted: local

Scan a git repository for values from untracked .env files that have leaked into tracked files or history (omerta check --all and omerta history), with the variable name reported and the value never printed.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && (git -C . rev-parse 2>&1 | head -1) && cat README.md 2>/dev/null | head -150
cd <guest-path> && sed -n 150,260p README.md; cat .python-version; grep -n "requires-python" pyproject.toml; ls scripts tests src/*; ls /inputs 2>&1; ls <guest-path> 2>&1; which uv uvx pip3; cat /etc/os-release | head -2
cd <guest-path> && git --version && git init -q && git remote add origin https://github.com/shcherbak-ai/omerta && timeout 120 git fetch --depth 1 origin 39c25768dfaf8e7b33ac0b06c705e501ac50be49 2>&1 | tail -5; echo "rc=$?"; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git log --oneline -1 2>&1; git status --short 2>&1 | head -20
cd <guest-path> && uvx omerta --version 2>&1 | tail -3; echo "rc=$?"; uvx omerta check --all 2>&1 | tail -10; echo "exit=${PIPESTATUS[0]}"
mkdir -p <guest-path> && cd <guest-path> && git init -q && git config user.email <email> && git config user.name demo && printf 'OPENAI_API_KEY=<secret>\n' > .env && printf 'import os\nKEY = "<secret>"\n' > src/client.py && git add src/client.py && git commit -qm "add client" && git status --short && git ls-files
cd <guest-path> && uvx omerta check --all; echo "exit=$?"; uvx omerta history; echo "hist_exit=$?"
cd <guest-path> && grep -n -i "pytest\|uv run\|make \|tasks.py\|nox" CONTRIBUTING.md | head -15; grep -rn -i "cron\|schedule\|webhook\|--once\|--now\|while True\|daemon\|watch" src/ README.md | head; ls .coldpass
cd <guest-path> && timeout 900 uv run --no-progress pytest -q -p no:cacheprovider 2>&1 | tail -8; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[
  {"kind":"claim","claim":"check --all reports a value from .env that is committed in a tracked file, naming the variable and never the value","source":"**Values** come from `.env` and `.env.*` at the root that git does not track.","input":"demo repo with .env OPENAI_API_KEY and the same value in tracked src/client.py","expected":"finding names OPENAI_API_KEY (from .env) at src/client.py:2, exit 1","probe_kind":"cli","argv":["uvx","omerta","-C","<guest-path>","check","--all"],"cwd":"<guest-path>","env":{},"expected_returncode":1,"expected_text":"src/client.py:2: OPENAI_API_KEY (from .env)"},
  {"kind":"claim","claim":"exit code is 1 when a finding is made","source":"The exit code is `0` when nothing is found, `1` when something is, and `2` on an error.","input":"same demo repo, history command","expected":"history finding for OPENAI_API_KEY, exit 1","probe_kind":"cli","argv":["uvx","omerta","-C","<guest-path>","history"],"cwd":"<guest-path>","env":{},"expected_returncode":1,"expected_text":"src/client.py: OPENAI_API_KEY (from .env)"}
]
EOF
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["uvx","omerta","-C","<guest-path>","check","--all"],"cwd":"<guest-path>","env":{},"expected_returncode":1,"expected_text":"src/client.py:2: OPENAI_API_KEY (from .env)"}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {"kind":"example","claim":"quick start: scan every tracked file of the pinned repo (clean, no env files)","source":"README.md Quick start","input":"omerta check --all in the pinned checkout","expected":"no findings, exit 0","argv":["uvx","omerta","check","--all"],"cwd":"<guest-path>","env":{},"expected_returncode":0},
  {"kind":"example","claim":"quick start: history scan of demo repo finds committed secret","source":"README.md Quick start / What it finds","input":"omerta history in demo repo","expected":"commit line naming OPENAI_API_KEY, exit 1","argv":["uvx","omerta","-C","<guest-path>","history"],"cwd":"<guest-path>","env":{},"expected_returncode":1,"expected_text":"src/client.py: OPENAI_API_KEY (from .env)"},
  {"kind":"example","claim":"repo's documented test command (CONTRIBUTING.md)","source":"CONTRIBUTING.md","input":"uv run pytest","expected":"237 passed, exit 0","argv":["uv","run","--no-progress","pytest","-q","-p","no:cacheprovider"],"cwd":"<guest-path>","env":{},"expected_text":"237 passed"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: src/omerta/cli.py commands check/history are one-shot; no cron, scheduler, --once/--now, webhook or watch loop in README or src/ (only a while True in git.py reading git output). omerta runs once per invocation, so there is no product cycle to trigger.","checks":[]}
EOF
python3 -I -c 'import json;[json.load(open(f)) for f in [".coldpass/claims.json",".coldpass/probe.json",".coldpass/examples.json",".coldpass/cycles.json"]];print("json ok")'
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && sed -i 's#"source":"README.md Quick start / What it finds"#"source":"README.md"#; s#"source":"README.md Quick start"#"source":"README.md"#; s#"source":"CONTRIBUTING.md"#"source":"CONTRIBUTING.md"#' .coldpass/examples.json && grep -o '"source":"[^"]*"' .coldpass/examples.json && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; python3 -I -c 'import json;d=json.load(open("<guest-path>"));print(d.get("valid"),d.get("problems"),d["replay"]["status"])'
grep -n "expected_returncode\|exited with code\|def .*example" <guest-path> | head -40
sed -n 1053,1200p <guest-path> | cut -c1-220
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[
  {"kind":"example","claim":"quick start: scan every tracked file of the pinned repo (no env files, clean)","source":"README.md","input":"omerta check --all in the pinned checkout","expected":"no findings, exit 0","argv":["uvx","omerta","check","--all"],"cwd":"<guest-path>","env":{}},
  {"kind":"example","claim":"quick start: history scan every commit, tag and message","source":"README.md","input":"omerta history in the pinned checkout","expected":"no findings, exit 0","argv":["uvx","omerta","history"],"cwd":"<guest-path>","env":{}},
  {"kind":"example","claim":"repo's documented test command (CONTRIBUTING.md)","source":"CONTRIBUTING.md","input":"uv run pytest","expected":"237 passed, exit 0","argv":["uv","run","--no-progress","pytest","-q","-p","no:cacheprovider"],"cwd":"<guest-path>","env":{},"expected_text":"237 passed"}
]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; python3 -I -c 'import json;d=json.load(open("<guest-path>"));print(d.get("valid"),d.get("problems"),d["replay"]["status"])'
cd <guest-path> && timeout 600 git fetch --unshallow origin 2>&1 | tail -3; echo "fetch_rc=${PIPESTATUS[0]}"; git rev-parse --is-shallow-repository; git log --oneline | wc -l; git status --short | head -5; uvx omerta history; echo "hist_exit=$?"
cd <guest-path> && git rev-parse HEAD && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; python3 -I -c 'import json;d=json.load(open("<guest-path>"));print(d.get("valid"),d.get("problems"),d["replay"]["status"])'
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Scan a git repository for values from untracked .env files that have leaked into tracked files or history (omerta check --all and omerta history), with the variable name reported and the value never printed.","operation_scope":"Linux Ubuntu 24.04 guest, Python 3.12.3, uv for uvx. Published omerta 0.1.1 via the README quick start (uvx omerta). Pinned source 39c25768 at <guest-path>, with full history fetched. Offline; no credentials or browser needed.","steps":["Read README.md; requirements are git 2.31+ and Python 3.11+ (uvx brings Python).","git init; git remote add origin https://github.com/shcherbak-ai/omerta; git fetch --depth 1 origin 39c25768dfaf8e7b33ac0b06c705e501ac50be49; git reset --mixed FETCH_HEAD (tree clean).","uvx omerta --version -> omerta 0.1.1.","uvx omerta check --all in the pinned checkout -> no findings, exit 0.","Built demo repo <guest-path> untracked .env with OPENAI_API_KEY, same value committed in src/client.py.","uvx omerta -C <guest-path> check --all -> 'src/client.py:2: OPENAI_API_KEY (from .env)', exit 1; value not printed.","uvx omerta -C <guest-path> history -> '8b05949... src/client.py: OPENAI_API_KEY (from .env)', exit 1.","uv run pytest -q -p no:cacheprovider (CONTRIBUTING.md) -> 237 passed.","uvx omerta history in the pinned checkout -> exit 0 after full-history fetch.","Checker validation with --replay: valid, no problems."],"deviations":["The prescribed --depth 1 fetch made the checkout shallow, so 'omerta history' refused to run ('this repository is a shallow clone'). Ran 'git fetch --unshallow origin' against the same pinned remote, as the README CI guidance (fetch-depth: 0) requires. HEAD stays at 39c25768.","README quick-start commands run through uvx use the published omerta 0.1.1 from PyPI, not the workspace source. Source was exercised separately by the repository's own pytest suite (237 passed).","The demo repo at <guest-path> is a synthetic secret test fixture outside the workspace; the demo values are fake.","Example for the nonzero (finding) case was not used as an example because the checker only accepts nonzero example exits when the README has an exit-code table; the README has none. The finding behaviour is covered by claims and probe.json instead.","/inputs/coldpass-preflight.py does not exist in this guest; the checker at <guest-path> was run as instructed."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the working path. Optional: the README could note that history needs a full clone so the --depth 1 pinning step is not a problem for users."}
EOF
python3 -I -c 'import json;d=json.load(open(".coldpass/report.json"));print("report ok", d["outcome"])'; ls -la .coldpass; ps aux | grep -c "[o]merta"
ps aux | grep "[o]merta" | cut -c1-200
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; python3 -I -c 'import json;d=json.load(open("<guest-path>"));print(d.get("valid"),d.get("problems"),d["replay"]["status"])'