updated

notes.txt

@@ -133,6 +133,115 @@ Output: Deployment completed successfully, but the generated URL returned 502 Ba
 
 Verdict: Partial / CLI issue — FastAPI deployment succeeds, but the auto-generated Dockerfile incorrectly starts python main.py instead of Uvicorn, causing the deployed application to be unreachable.
 
+
+Secret Exposure Test
+
+Command: gy deploy --debug
+
+Test: Created a test project containing fake credentials in .env and config.txt.
+
+Steps: Deployed the project and reviewed the CLI output and application logs to check whether the test credentials were exposed.
+
+Result: Deployment completed successfully. The application logs did not contain the test credentials.
+
+
+Sensitive File Inclusion Test
+
+Command: gy deploy --debug
+
+Test: Verified whether sensitive files excluded by .dockerignore are included in the deployed container.
+
+Steps: Created .dockerignore rules excluding .env and config.txt. Added a Dockerfile that lists the contents of /app, then deployed the project and inspected the application logs.
+
+Result: Deployment completed successfully. The deployed container contained only the Dockerfile and .dockerignore; .env and config.txt were not included.
+
+Output:
+total 16
+.dockerignore
+Dockerfile
+
+Verdict: Pass — the deployment respected the .dockerignore rules and excluded the sensitive test files from the deployed container.
+
+Output:
+Ready! Add a CMD to your Dockerfile
+
+Verdict: No secret exposure observed in the CLI output or application logs during this test.
+
+
+Security – Sensitive File Exposure
+
+Command: gy deploy
+
+Requirements: A project containing sensitive-looking files such as .env and config.txt.
+
+Steps: Created a test project containing a fake access key in .env and a fake password in config.txt. Deployed the project using gy deploy --debug, then checked the deployed container using gy logs.
+
+Result: The deployed container filesystem contained both .env and config.txt, meaning these files were included in the deployment by default.
+
+Output:
+.env
+Dockerfile
+config.txt
+
+Verdict: Potential security issue: Sensitive files are not automatically excluded from the deployment. In a real project, this could expose credentials or other sensitive configuration.
+
+
+Git Metadata Exposure Test
+
+Command: gy deploy --debug
+
+Test: Verified whether the .git directory and Git metadata are included in the deployed container.
+
+Steps: Created a Git repository in the test project and committed project files. Added a Dockerfile that checks for the .git directory and .git/config, then deployed the project and inspected the application logs.
+
+Result: Deployment completed successfully. The deployed container did not contain the .git directory or Git metadata.
+
+Output:
+
+=== GIT CHECK ===
+ls: .git: No such file or directory
+=== CONFIG CHECK ===
+cat: can't open '.git/config': No such file or directory
+
+Verdict: Pass — the deployment excluded the .git directory and Git metadata from the deployed container.
+
+Verdict: No Git metadata exposure observed in the deployed container.
+
+Dockerfile Hardcoded Secret Detection Test
+
+Command: gy deploy --debug
+
+Test: Verified whether the CLI detects and warns about hardcoded secrets defined in the Dockerfile.
+
+Steps: Created a Dockerfile containing a fake secret using ENV TEST_SECRET="FAKE_SECRET_12345", deployed the application, and inspected the deployment output and application logs.
+
+Result: Deployment completed successfully without any security warning or secret-detection message. The hardcoded secret was accessible inside the running container and appeared in the application logs.
+
+Output:
+
+Application started
+TEST_SECRET=FAKE_SECRET_12345
+
+Verdict: Fail — The CLI did not detect or warn about the hardcoded secret defined in the Dockerfile ENV instruction.
+
+AI Secret Detection Test
+
+Command: `gy deploy --debug --ai-key="$GY_AI_KEY"`
+
+Test: Verified whether the CLI's AI-assisted detection identifies and warns about hardcoded secrets in the project source code.
+
+Steps: Created a test project containing a fake hardcoded API key in `app.sh`, deployed the application with AI-assisted detection enabled using `--ai-key="$GY_AI_KEY"`, and inspected the deployment output and application logs.
+
+Result: Deployment completed successfully without any security warning or secret-detection message. The CLI did not indicate that the hardcoded API key was detected.
+
+Output:
+
+Application started
+
+
+Verdict: Fail — The CLI's AI-assisted detection did not detect or warn about the hardcoded API key during deployment.
+
+
 Problems
 
 Duplicate Names Problem
@@ -159,3 +268,23 @@ FastAPI Auto-Generated Dockerfile Problem
 The CLI successfully detects FastAPI and generates a Dockerfile, but the generated Dockerfile uses CMD ["sh", "-c", "python main.py"]. Since the FastAPI application only defines the app object and does not start a web server, the container does not listen on the configured port, resulting in 502 Bad Gateway. The CLI should generate a FastAPI-compatible command such as Uvicorn with 0.0.0.0 and the configured port.
 
 
+Security – Sensitive File Exposure
+
+The CLI deploys sensitive-looking files such as .env and config.txt to the container by default. No automatic detection or exclusion was observed. In a real project, this could expose credentials or other sensitive configuration.
+
+Impact: Potential exposure of secrets if sensitive files are included in the project.
+
+Security – Dockerfile Secret Exposure
+
+The CLI allows hardcoded secrets defined in the Dockerfile using the `ENV` instruction to be deployed without any security warning or detection. The secret was accessible inside the running container and appeared in the application logs.
+
+Impact: Potential exposure of credentials or other sensitive values when secrets are hardcoded directly in the Dockerfile.
+
+Security – AI Secret Detection
+
+The CLI provides an AI-assisted secret detection feature through the `--ai-key` option, but no warning or detection was observed when deploying a project containing a hardcoded API key.
+
+Impact: Potential exposure of hardcoded secrets if the AI-assisted detection fails to identify sensitive credentials before deployment.
+
+Verdict: Fail — With AI-assisted detection enabled using `--ai-key`, the CLI successfully deployed the project without detecting or warning about the hardcoded API key.
+