LingTai Security Audit Reference

LingTai Security Audit Reference

Nested lingtai-dev-guide reference. Read this after the top-level router sends you here.

Read the lingtai-kernel-anatomy skill first to understand the architecture. This document audits against the LingTai filesystem layout, process model, and communication mechanisms.

Core Principle

This audit framework is strictly read-only. Scan, report, recommend — but never modify any files. All fixes must be performed manually by authorized personnel with appropriate permissions.

Two rules bind every dimension below: pattern matching produces false positives, so every hit needs manual verification; and the report must never contain an actual secret value — report "match found" with the value replaced by <REDACTED>, or the report itself becomes the leak.

Each dimension is scoped to a scan_dir:

scan_dir="<network-dir>"

Audit Dimensions

1. Secret Leak Pattern Scan

Detects API keys, tokens, and credentials exposed in the network directory — .env files committed during development, MCP configurations with keys written inline instead of referencing environment variables, and debug logs that captured full authentication headers.

# Scan every known secret type; persist matching file paths only
scan_dir="<network-dir>"
report="/tmp/security-scan-$(date +%Y%m%d-%H%M%S).txt"

{
  echo "=== Security Scan: $(date) ==="
  echo "Target: $scan_dir"
  echo ""

  patterns=(
    "ghp_[0-9a-zA-Z]{36}:GitHub PAT"