Rye Valley
/
Library
Businesses
Recent
MH
Michael Houck
Owner
Settings

Live Google OAuth credential leaked in clawdy-architecture, needs rotation

entityRye Valley
statusdecided
date2026-07-31
decidersMichael Houck, Hermes Agent

2 min read

  • Closed: 2026-08-02

What was found

clawdy-architecture (Ben’s Megaphone/Cape OpenClaw workspace, formerly at benorn213/clawdy-architecture, transferred into RyeValley 2026-07-30) had a live Google OAuth “installed app” client secret checked into git history at client_secret_oclaw.json:

client_id: 185758890107-8lte2octffqumuc81fjb3u92m8g66ro8.apps.googleusercontent.com
project_id: oclaw-493701
client_secret: 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

Only 1 commit ever touched the file (added once, never modified), but it was public/private-repo-visible on GitHub since that commit, so the secret must be treated as compromised (any GitHub collaborator, or historically if the repo was ever public/exposed, could have read it).

Remediation done (Hermes, 2026-07-31)

  1. Stripped client_secret_oclaw.json from ALL git history (every branch: main, workspace-connie, workspace-eddie-tor, workspace-trent) via git filter-repo before folding clawdy-architecture into casper-and-friends. Verified zero hits for the secret string across the full rewritten history.
  2. The merged repo (RyeValley/casper-and-friends, PR #1) and its clawdy/ subdirectory contain NO trace of the credential.
  3. Old RyeValley/clawdy-architecture repo archived (read-only, not deleted) so nothing else silently depends on it.

Resolution (2026-08-02)

Rotation was not performed. The GCP project oclaw-493701 is owned by Ben’s personal Google account (ben@foundingjourney.com) and Michael does not have IAM access to it. Ben does not have sufficient familiarity with GCP Console to do it himself without risk of confusion.

Risk accepted as low: Cape/OpenClaw is defunct, the repo was private/limited-access, and the git history scrub removed the primary exposure vector. This credential has no active consumers. No further action planned - do not revisit.

Standing lesson for future repo intake

Before folding or transferring any externally-authored repo into RyeValley, scan for committed secrets first (grep for client_secret, api_key, _TOKEN, BEGIN.*PRIVATE KEY, .env files) as a standard step, not an afterthought.

← Blake Emal Announced as Content Lead to Remaining Megaphone ClientsJolt agent client-context architecture: convergence plan to rule-card layers →

Backlinks