17 lines
854 B
Markdown
17 lines
854 B
Markdown
# Incident Note: Gitea Chat Bridge Credential Exposure
|
|
|
|
**Affected Service:** `gitea-chat-bridge` in `us-central1`
|
|
|
|
**Exposure:** A public Cloud Run service was discovered to have a credential configured as a literal environment variable.
|
|
|
|
**Risk:** The exposed credential could allow unauthorized posting to an integrated chat destination. The credential itself is compromised.
|
|
|
|
**Immediate Decision:** The `gitea-chat-bridge` service will not be used in the new OPAX web terminal architecture.
|
|
|
|
**Remediation:**
|
|
|
|
1. The exposed webhook should be revoked and replaced.
|
|
2. The new credential should be stored in Secret Manager.
|
|
3. The service's deployment configuration must be updated to reference the new secret from Secret Manager.
|
|
4. The Cloud Run service's ingress should be reviewed and potentially restricted if public access is not required.
|