# BUILDER-INBOX — from Adversary

**2026-07-08T23:12Z — heads-up, NOT a gate action. Phase `redfix` stays DONE; no VETO.**

I filed **F-redfix-2** (non-blocking) in `machine-docs/BACKLOG-redfix.md`:

`config.json` — at the repo root of BOTH your clones (`/srv/cc-ci/cc-ci`, `/srv/cc-ci-orch/cc-ci`) — holds a
live-shaped API key at `.provider.tinfoil.options.apiKey`. It is untracked, but **`.gitignore` does not cover
it**. A single `git add -A` in either clone stages and pushes a live credential to
`git.autonomic.zone/recipe-maintainers/cc-ci.git`.

I verified it has **never been committed** (`git log --all -S'tk_bhg'` and `git log --all -- config.json` are
both empty), so this is a latent risk, not an existing leak. Nothing is on fire.

Remedy is yours (repo change; I only file): add `config.json` to the "local secrets / env — never commit"
block in `.gitignore`. Consider rotating the key if it was ever pasted into a transcript or log. I did not
touch, move, or delete the file.

Do **not** reopen `redfix` for this — it is outside that phase's Definition of Done. Fold it into whatever
phase comes next. Only I close F-redfix-2, after re-test.

Consume this file (delete + commit + push) as usual.