Problem
docs/internal-deployment.md has been deleted from HEAD (commit be777a3), but it remains
reachable in git history and is already published on this repo, so deletion alone does not unpublish it.
Content that was exposed:
- a real AWS account id (all stages shared it)
- Brazil pipeline deployment-group ids
- an internal Harmony app URL (
*.a2z.com)
- a
code.amazon.com package link
- a Bindle (access-control) resource URL
Assessment
None of these are credentials, and the internal URLs are unreachable without corporate auth. The
account id is the main residual: it is an identifier useful for targeting, not a secret by itself.
Options
- Accept the residual exposure and rely on the HEAD deletion (lowest effort).
- Rewrite history (
git filter-repo) and force-push, plus rotate/redact anything considered
sensitive. This breaks existing clones and forks.
Needs an owner decision — deliberately not actioned unilaterally.
Found by a pre-release security audit.
Problem
docs/internal-deployment.mdhas been deleted from HEAD (commitbe777a3), but it remainsreachable in git history and is already published on this repo, so deletion alone does not unpublish it.
Content that was exposed:
*.a2z.com)code.amazon.compackage linkAssessment
None of these are credentials, and the internal URLs are unreachable without corporate auth. The
account id is the main residual: it is an identifier useful for targeting, not a secret by itself.
Options
git filter-repo) and force-push, plus rotate/redact anything consideredsensitive. This breaks existing clones and forks.
Needs an owner decision — deliberately not actioned unilaterally.
Found by a pre-release security audit.