The wolf found a key under the doormat

The problem

There's a GitHub PAT baked into the git remote URL:

origin https://woltspace:<PAT>@github.com/jerpint/woltspace.git

This means every git remote -v, every debug log, every subprocess that touches the remote leaks the token in plaintext. Today the wolf read it off the floor to authenticate gh — that shouldn't have been possible.

The PAT should live in .env (where secrets belong) and get injected at auth time through a credential helper or GH_TOKEN, not welded into the remote.

What needs to happen

1. Strip the PAT from the remote URL — git remote set-url origin https://github.com/jerpint/woltspace.git
2. Add GITHUB_TOKEN to .env — single source of truth for the PAT
3. Configure a git credential helper that reads from .env (or use GH_TOKEN env var for gh commands)
4. Audit other remotes — check all wolts for the same pattern (wolts/*/ repos)
5. Rotate the PAT — the current one has been logged in shell history and tool outputs

The rule going forward

Secrets live in .env. Nowhere else. No embedding in URLs, no hardcoding in scripts, no "just this once." If a creature needs auth, it reads from .env at runtime.

Priority

High — this is a live credential in a place that gets printed by default tooling.

🐺 Howlie found this one. Good wolf.

Start by inspecting git remotes across the wolts/*/ repositories and checking how .env and gh authentication are handled. Verify that no remote, shell history, tool output, or script contains the PAT, then confirm the remote uses the clean GitHub URL, authentication reads from .env or GH_TOKEN, and the exposed token is rotated.