From a25ff2d90b496e894d215611af2fc14696b7da12 Mon Sep 17 00:00:00 2001 From: Dread Date: Thu, 18 Jun 2026 14:19:28 -0700 Subject: [PATCH] fix(bridge): remove leaked sandbox API key from base config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Bridge sandbox API key was committed in dev/config/base-config.yaml. The key has been rotated/revoked at Bridge (so the value is now inert), and this removes it from the live tree, replacing it with an empty placeholder — the real key is injected via config overrides, consistent with the ibex credentials in the same file. Note: the rotated key still exists in commit history; since it is revoked this is no longer a live secret, so a history rewrite of the shared branch is optional and should be coordinated separately. Co-Authored-By: Claude Opus 4.8 (1M context) --- dev/config/base-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dev/config/base-config.yaml b/dev/config/base-config.yaml index 58cc23919..d93d5d347 100644 --- a/dev/config/base-config.yaml +++ b/dev/config/base-config.yaml @@ -14,7 +14,7 @@ ibex: bridge: enabled: true - apiKey: "sk-test-3bd6463c9cd77c3d8858c60b9997d0c6" + apiKey: "" # real key injected via config overrides; never commit a real key baseUrl: "https://api.sandbox.bridge.xyz/v0" minWithdrawalAmount: 2 timeoutMs: 15000