gitleaks Cloudflare tunnel token leak: rotating it took my tunnel down

Description and use

<p>I keep a private GitHub repo that snapshots my homelab's live configuration every night: reverse proxy, cron jobs, systemd units, router settings, and the full <code>docker inspect</code> of every container on the NAS. The NAS has no compose files worth trusting, so <code>docker inspect</code> is the closest thing it has to configuration.</p> <p>The repo was built to be safe to push, and it had several layers of protection. It still leaked a live Cloudflare tunnel token for nearly three weeks. Then, when I rotated that token, I took my own tunnel down. Both failures are worth writing up.</p

Problem

<p>I keep a private GitHub repo that snapshots my homelab's live configuration every night: reverse proxy, cron jobs, systemd units, router settings, and the full <code>docker inspect</code> of every container on the NAS. The NAS has no compose files worth trusting, so <code>docker inspect</code> is the closest thing it has to configuration.</p> <p>The repo was built to be safe to push, and it had several layers of protection. It still leaked a live Cloudflare tunnel token for nearly three weeks. Then, when I rotated that token, I took my own tunnel down. Both failures are worth writing up.</p

Outcome

<p>I keep a private GitHub repo that snapshots my homelab's live configuration every night: reverse proxy, cron jobs, systemd units, router settings, and the full <code>docker inspect</code> of every container on the NAS. The NAS has no compose files worth trusting, so <code>docker inspect</code> is the closest thing it has to configuration.</p> <p>The repo was built to be safe to push, and it had several layers of protection. It still leaked a live Cloudflare tunnel token for nearly three weeks. Then, when I rotated that token, I took my own tunnel down. Both failures are worth writing up.</p

Evidence

gitleaks Cloudflare tunnel token leak: rotating it took my tunnel down

Source