Remove private/internal references from 2026-07-14 - #8
Open
boardwalk-bot[bot] wants to merge 1 commit into
Open
boardwalk-bot[bot] wants to merge 1 commit into
boardwalk-bot[bot] wants to merge 1 commit into
Conversation
Automated remediation for daily private reference scan.
![boardwalk-bot[bot]](https://avatars.githubusercontent.com/in/4148749?s=60&v=4){kind=small}
Author
There was a problem hiding this comment.
Automated review: changes suggested
The hostname fixture is generalized correctly, but the PR does not fully deliver its stated remediation: the private Claude session URL remains exposed in the PR metadata and no README change is shown.
Findings
- major
PR description / commit-message metadata: The PR claims to removehttps://claude.ai/code/session_01MK51DnD8bjW7JvkzHKDawd, but reproduces that exact URL in its public description, and the supplied diff contains no README or metadata remediation. Remove the URL from the PR description and rewrite the affected commit message/history as applicable before merging.
Posted by the Boardwalk PR reviewer (non-blocking).
nrcrews
added a commit
that referenced
this pull request
Aug 4, 2026
…ace run attribution Two Lifeguard dogfood findings, both CLI-side gaps over server capabilities that already shipped. #2: rotate-in-place has existed server-side since the backend's d662cdaf (POST /v1/secrets/:id/rotate, PutSecretValue at the same ARN, secret:rotate already in the elevated CLI scopes) but the CLI never exposed it, so repairing a mangled value meant a rename + descriptor change + redeploy of every consumer. `secrets set` is now an upsert: on a 409 it resolves the name to its id and rotates. A name that exists only inside an environment still surfaces the conflict — guessing which environment was meant would write the wrong tenant's credential. #8: RunListItem now carries costUsd + the resolved concurrencyKey/workspaceKey when the server reports them (absent otherwise, so --json on an older server shows no misleading nulls). This also fixes `runs <id>`'s Spend line, which was declared and rendered but never parsed, so it never appeared. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019FfM1VMV8KiRsX6cfw6dA6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated remediation from Boardwalk's daily private reference scan.
Summary: Two high-severity findings were identified in the public repo boardwalk-labs/cli: a direct link to an internal Claude code session and a hardcoded internal hostname in a public test case. Both represent unnecessary exposure of private workflow artifacts and internal infrastructure details.
Findings addressed:
README (commit message context):https://claude.ai/code/session_01MK51DnD8bjW7JvkzHKDawd— Remove the Claude-Session URL from the commit message and any associated documentation. If session context needs to be preserved for internal review, store it in an internal ticket or private notes rather than public commit history.src/render/renderer.test.ts:internal.example— Replace 'internal.example' with a fully generic placeholder like 'blocked-host.example.com' or use a constants file with clearly generic test values (e.g., 'test-host.example.com') that do not imply internal infrastructure.Commit message context:Claude Fable 5 <noreply@anthropic.com>— Generalize the co-author to 'AI Assistant' or remove the specific internal codename if it is not publicly documented. However, since the email is from Anthropic's public domain, this is likely a low-risk artifact of the AI coding tool.Please review carefully before merging. If any finding involved an actual credential, rotate it out-of-band.