메뉴
Security audit checklist for public GitOps/home-lab repositories. Use when asked to audit a public repo for exposed secrets, assess what is safe to make public, or review a home-lab GitOps setup for information leaks.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | secops-public-repo-audit |
| description | Security audit checklist for public GitOps/home-lab repositories. Use when asked to audit a public repo for exposed secrets, assess what is safe to make public, or review a home-lab GitOps setup for information leaks. |
| when_to_use | Trigger phrases: "audit repo", "public repo security", "exposed secrets", "safe to make public", "security review", "check gitignore", "secops". |
| user-invocable | false |
Extracted: 2026-03-24 Context: Auditing a public GitHub repo (home-ops / GitOps pattern) for information leaks
Security audits of home-lab repos often flag generated config files (Talos machine configs, Terraform state, kubeconfigs) as CRITICAL — but these files are frequently gitignored and never actually on GitHub. Escalating without verifying wastes effort and creates false urgency.
# Is the file tracked?
git ls-files <path>
# Has it EVER been committed (even if deleted)?
git log --all --oneline -- <path>
# What's gitignored in that directory?
cat <dir>/.gitignore
Only escalate to CRITICAL if git ls-files returns the file AND it contains real secrets.
| Area | What to check | Common false positives |
|---|---|---|
| Generated configs | clusterconfig/*.yaml, kubeconfig, talosconfig | Usually gitignored |
| Terraform state | terraform.tfstate, .tfvars | Usually gitignored |
| Secret UUIDs | Bitwarden/Vault UUIDs in .tf files | Useless without auth token |
| Encrypted files | *.sec.yaml, SOPS files | Encrypted — check the algo |
| Network topology | IPs, hostnames in docs | RFC1918 = unreachable from internet |
| Domain names | Real domain in committed files | Check if Cloudflare proxied |
If the repo uses Cloudflare Tunnel + proxying:
Audit CloudNativePG (CNPG) clusters for backup health, S3 storage bloat, and disk-space risk — schedule misconfiguration, WAL/archive_timeout churn, orphaned backups, compression, and PVC resize status. Use when investigating CNPG backup storage growth, a "storage near empty" alert on the backup target (e.g. QNAP), a crash-looping/"Not enough disk space" CNPG cluster, or doing a periodic CNPG health check.
Push an updated Coder workspace Terraform template and redeploy running workspaces onto it. Use when workspace-template/main.tf changes (resources, volumes, etc.) need to reach live Coder workspaces.
Diagnose and fix ONLYOFFICE Document Server showing "An error has occurred while opening the file" with no failed requests visible in the browser. Root cause is usually an orphaned task_result row in the docserver's Postgres DB, left over from a conversion interrupted by a pod crash/OOM/restart.
Task commands, bootstrap sequence, CI/CD, branch/PR workflow, linting, and devcontainer setup for the home-ops repository.
Use when auditing disk health, filesystem usage, or I/O on cluster nodes — especially when filesystem queries return incomplete results or a node's second drive is missing from metrics.
Use when removing, replacing, or decommissioning a Talos node — covers the correct talosctl reset workflow