Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

chore: tracker-leak pre-push scanner needs CI-side backstop + wider coverage

Open
#1,142 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
git, github-actions, typescript
Domain
ci-cd, devtools, security

Research direction

Start with script/check-tracker-leaks.ts, then inspect .github/workflows/* and the .claude/rules/* hostnames it references. Compare the existing pre-push patterns with the proposed CI backstop and wider RULES coverage; done means the agreed checks run in CI and the documented scope matches the enforced patterns.

Written by the indexing model from the issue text.

Description

Found during v0.9.7 release review (CTO + Chaos Gremlin personas), and already self-disclosed in the originating commit (205a953d62 / PR #1085).

The pre-push tracker-leak scanner (script/check-tracker-leaks.ts) currently:

  • Covers exactly two patterns: Jira key (\bAI-\d+) and the altimateai.atlassian.net hostname.
  • Has no CI-side mirror — the originating PR deferred this because the session's token lacked workflow scope to add .github/workflows/*.
  • Is bypassable via SKIP_TRACKER_CHECK=1 or simply never installed (git config core.hooksPath .husky is opt-in).

A contributor merging via the GitHub UI, the API, or without the hook installed gets zero enforcement today. The scanner's own docs ('public repo hardening') can read as more comprehensive than it is.

Suggested follow-up:

  1. Add a CI job mirroring the pre-push check (needs a workflow-scoped token).
  2. Widen RULES to cover other internal-only hostnames referenced in this repo's own .claude/rules/* (e.g. onealtimate.com), not just the Atlassian one.
  3. Consider whether customer/tenant name patterns or credential-shaped strings (AWS keys, connection strings) belong in scope, or should be a separate secret-scanning tool.
Dominant language
TypeScript
Stars
813
Forks
134
Avg merge
2d 5h
Merged PRs (30d)
63

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from AltimateAI/altimate-code

All issues in AltimateAI/altimate-code

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.