Skip to content

Security: taskade/docs

Security

SECURITY.md

🔒 Security Guidelines for Contributors

⚠️ CRITICAL: This is a PUBLIC repository that powers docs.taskade.com. Never commit sensitive information!

🚨 What NEVER to Commit

Environment Variables & Secrets

# ❌ NEVER commit these files:
.env
.env.local
.env.production
.env.development
*.key
*.pem
*credentials*
*secrets*
config/local.json
config/production.json

API Keys & Tokens

# ❌ Examples of what NOT to commit:
TASKADE_API_TOKEN=your_api_token_here
GITHUB_TOKEN=your_github_token_here
DATABASE_URL=postgres://user:password@host:5432/db
OPENAI_API_KEY=your_openai_key_here

Import Scripts & Temporary Data

# ❌ These are also excluded:
scripts/                    # Import/sync scripts
package.json               # Node dependencies for scripts
*-urls.txt                 # Temporary URL lists
help-center/_imported/     # Imported content (temporary)

✅ Safe Practices

1. Use Template Files

Instead of .env, create .env.example.template:

# ✅ Safe template example:
# .env.example.template
TASKADE_API_TOKEN=your_api_token_placeholder
GITHUB_TOKEN=your_github_token_placeholder
OPENAI_API_KEY=your_openai_key_placeholder

2. Check Before Committing

Always run these commands before committing:

# Check what you're about to commit
git status
git diff --cached

# Look for sensitive patterns
git diff --cached | grep -i -E "(token|key|secret|password|credential)"

# Verify .gitignore is working
git ls-files | grep -E "\.(env|key|pem)$"

3. Use Git Hooks (Recommended)

Create .git/hooks/pre-commit:

#!/bin/bash
# Check for sensitive files
if git diff --cached --name-only | grep -E "\.(env|key|pem)$"; then
    echo "❌ ERROR: Attempting to commit sensitive files!"
    echo "Files found:"
    git diff --cached --name-only | grep -E "\.(env|key|pem)$"
    exit 1
fi

# Check for sensitive content
if git diff --cached | grep -i -E "(token|key|secret|password|credential)" | grep -v "placeholder"; then
    echo "❌ ERROR: Potential sensitive content detected!"
    echo "Content found:"
    git diff --cached | grep -i -E "(token|key|secret|password|credential)" | grep -v "placeholder"
    exit 1
fi

🛡️ If You Accidentally Commit Secrets

Immediate Actions

  1. DO NOT PUSH if you haven't already
  2. Remove the sensitive file and commit:
git rm .env
git commit -m "Remove accidentally added .env file"
  1. If already pushed, immediately revoke/rotate the exposed credentials
  2. Contact the team lead immediately

Clean Git History

If secrets were pushed, use BFG Repo-Cleaner:

# Download BFG
wget https://repo1.maven.org/maven2/com/madgag/bfg/1.14.0/bfg-1.14.0.jar

# Remove sensitive files from history
java -jar bfg-1.14.0.jar --delete-files .env
java -jar bfg-1.14.0.jar --replace-text passwords.txt

# Force push (coordinate with team!)
git push --force

📋 Pre-Commit Checklist

Before every commit, verify:

  • ✅ No .env files in staging area
  • ✅ No API keys/tokens in code
  • ✅ No credentials in configuration files
  • ✅ No temporary import scripts
  • ✅ No sensitive URLs or endpoints
  • ✅ All secrets use placeholder values like your_token_placeholder

🔍 Repository Structure

Public Content (✅ Safe to commit)

docs.taskade.com/
├── README.md              # Public documentation
├── api/                   # API documentation
├── features/              # Feature guides
├── genesis/               # Genesis documentation
├── automation/            # Automation guides
└── .gitbook/assets/       # Public images/assets

Private/Hidden Content (❌ Never commit)

Local Development Only:
├── .env                   # Environment variables
├── scripts/               # Import/sync scripts
├── help-center/_imported/ # Temporary imported content
├── package.json           # Script dependencies
└── *-urls.txt            # Temporary URL lists

🚨 Emergency Contacts

If you accidentally commit sensitive information:

  1. Immediate: Stop all commits/pushes
  2. Contact: Team lead or repository maintainer
  3. Action: Revoke/rotate exposed credentials immediately
  4. Follow-up: Clean git history if necessary

📚 Additional Resources

Remember: This repository is PUBLIC and powers our documentation site. When in doubt, ask before committing!

There aren’t any published security advisories