OSVauco/incident-note-gitea-chat-bridge.md

Incident Note: Gitea Chat Bridge Credential Exposure

Affected Service: gitea-chat-bridge in us-central1

Exposure: A public Cloud Run service was discovered to have a credential configured as a literal environment variable.

Risk: The exposed credential could allow unauthorized posting to an integrated chat destination. The credential itself is compromised.

Immediate Decision: The gitea-chat-bridge service will not be used in the new OPAX web terminal architecture.

Remediation:

1. The exposed webhook should be revoked and replaced.
2. The new credential should be stored in Secret Manager.
3. The service's deployment configuration must be updated to reference the new secret from Secret Manager.
4. The Cloud Run service's ingress should be reviewed and potentially restricted if public access is not required.