openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #214] Upddated #294

New Issue
Closed
opened 2026-02-15 17:16:42 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:42 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/openclaw/clawhub/pull/214

State: closed
Merged: No

Greptile Overview

Greptile Summary

This PR populates .env.local.example with localhost values and adds a package-lock.json file. It must not be merged due to a critical security issue: real GitHub OAuth credentials (AUTH_GITHUB_ID and AUTH_GITHUB_SECRET) are hardcoded into the example env file, violating the project's own security policy ("never commit secrets" — AGENTS.md). These credentials need to be revoked immediately regardless of whether this PR is merged.

  • Security: GitHub OAuth secrets committed — AUTH_GITHUB_ID and AUTH_GITHUB_SECRET in .env.local.example contain real credentials that are now exposed in git history. These must be revoked and the commit scrubbed from history.
  • Incorrect value for VITE_SITE_MODE — set to http://localhost:3000 but this is a mode flag, not a URL. Will likely cause runtime issues.
  • package-lock.json added (10k+ lines) — this project uses bun (lockfile: bun.lock). Committing an npm package-lock.json is unnecessary and could cause confusion with duplicate lockfiles.
  • PR title is a typo — "Upddated" doesn't follow the project's Conventional Commits convention (feat:, fix:, chore:, etc.).

Confidence Score: 1/5

  • This PR must not be merged — it contains exposed OAuth secrets and incorrect configuration values.
  • Score of 1 due to real GitHub OAuth credentials committed to the repository in an example env file. This is a security incident that requires immediate credential rotation. Additionally, VITE_SITE_MODE is set to an incorrect value, and an unnecessary package-lock.json is added to a bun-based project.
  • .env.local.example requires immediate attention — contains leaked OAuth secrets. package-lock.json should not be committed in this bun-based project.

(2/5) Greptile learns from your feedback when you react with thumbs up/down!

Context used:

  • Context from dashboard - AGENTS.md (source)
**Original Pull Request:** https://github.com/openclaw/clawhub/pull/214 **State:** closed **Merged:** No --- <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR populates `.env.local.example` with localhost values and adds a `package-lock.json` file. **It must not be merged** due to a critical security issue: real GitHub OAuth credentials (`AUTH_GITHUB_ID` and `AUTH_GITHUB_SECRET`) are hardcoded into the example env file, violating the project's own security policy ("never commit secrets" — `AGENTS.md`). These credentials need to be revoked immediately regardless of whether this PR is merged. - **Security: GitHub OAuth secrets committed** — `AUTH_GITHUB_ID` and `AUTH_GITHUB_SECRET` in `.env.local.example` contain real credentials that are now exposed in git history. These must be revoked and the commit scrubbed from history. - **Incorrect value for `VITE_SITE_MODE`** — set to `http://localhost:3000` but this is a mode flag, not a URL. Will likely cause runtime issues. - **`package-lock.json` added (10k+ lines)** — this project uses `bun` (lockfile: `bun.lock`). Committing an npm `package-lock.json` is unnecessary and could cause confusion with duplicate lockfiles. - **PR title is a typo** — "Upddated" doesn't follow the project's Conventional Commits convention (`feat:`, `fix:`, `chore:`, etc.). <h3>Confidence Score: 1/5</h3> - This PR must not be merged — it contains exposed OAuth secrets and incorrect configuration values. - Score of 1 due to real GitHub OAuth credentials committed to the repository in an example env file. This is a security incident that requires immediate credential rotation. Additionally, VITE_SITE_MODE is set to an incorrect value, and an unnecessary package-lock.json is added to a bun-based project. - `.env.local.example` requires immediate attention — contains leaked OAuth secrets. `package-lock.json` should not be committed in this bun-based project. <!-- greptile_other_comments_section --> <sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub> **Context used:** - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=a1d58d20-b4dd-4cbb-973a-9fd7824e1921)) <!-- /greptile_comment -->
yindo added the pull-request label 2026-02-15 17:16:42 -05:00
yindo closed this issue 2026-02-15 17:16:43 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#294
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?