{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=dotisacat/git-credential-exposure@0.1.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"The three places git authentication leaks in cleartext, all covered in one sweep. Five jobs: scan_global reads ~/.git-credentials -- the file \u0060credential.helper=store\u0060 writes, one URL per stored credential -- parsing every line as a URL and reducing every embedded user:token pair it finds to HOST, a token SHAPE (a recognized pattern -- sk-, ghp_, gho_, xox[bp]-, AKIA, an eyJ-led JWT -- else the generic \"stored-credential\" bucket), and a 4-character-plus-length preview -- NEVER the token itself, and never the username either, which can itself be a real email or personal identifier this play has no business repeating; the file's own permission bits are read via os.stat and flagged whenever group- or world-readable, since a credential store readable by anyone but its owner is its own finding regardless of what it contains. scan_global also resolves the EFFECTIVE \u0060credential.helper\u0060 value at system and global scope, in that order, via \u0060git config <scope> --get-all credential.helper\u0060 (never re-derived by hand, nev","distribution":{"digest":"sha256:c408b115f584dfc3313ded9141485bbbf49b598148d6805a790e68cb8929191d","mediaType":"application/vnd.modiqo.rote-flow","size":33979,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0.json"},"name":"git-credential-exposure","owner":{"kind":"user","slug":"dotisacat"},"parameters":[{"default":"~/Documents","description":"Folder to sweep for git repositories whose local credential.helper and remotes get checked. Tilde expands to your home directory; relative paths resolve against the run workspace, not wherever you were thinking of -- prefer absolute paths.","example":"~/Documents","input":{"allowCustom":true,"choices":[],"label":"Base dir"},"name":"base_dir","required":false,"type":"string"},{"default":3,"description":"How many directory levels below base_dir to search for repositories (1-6)","example":3,"input":{"allowCustom":true,"choices":[],"label":"Max depth"},"name":"max_depth","required":false,"type":"integer"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/dotisacat/git-credential-exposure@0.1.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.77.0"},"publishedAt":"2026-09-02T21:19:12.469146+00:00","reference":"dotisacat/git-credential-exposure@0.1.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3","git"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":1,"installs":0},"steps":{"count":2,"names":["scan_global","scan_repos"]},"title":"git-credential-exposure","type":"play","version":"0.1.0","visibility":"public"}