david.delagneau
2a234701c5
- Updated work items with new statuses, notes, and dependencies: - `PDIAP-15838` moved to Done, draft PR remains unmerged. - `PDIAP-15836` status updated to backlog-ready, sequenced after `PDIAP-15838`. - `PDIAP-12284` reopened for UIKit removal, dependency for `PDIAP-15836`. - Added new backlog items: `PDIAP-11961`, `PDIAP-11962`, `PDIAP-11562`, `PDIAP-12226`, `PDIAP-12227`, `PDIAP-12228`. - Completed `PDIAP-16167`, documented findings in Confluence. - Created daily log for 2026-05-05 summarizing work item updates and backlog triage. - Added diagnostic script for workspace analysis.
1.5 KiB
1.5 KiB
type, project, status, ticket, title, systems, workstreams, people, related, updated, tags
| type | project | status | ticket | title | systems | workstreams | people | related | updated | tags | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| work-item | fidelity | backlog | PDIAP-11961 | Remediation of Exposed Secrets in XFlow iOS SDK - Request for Rotation/Invalidation |
|
|
|
|
2026-05-05 |
|
PDIAP-11961 - Remediation of Exposed Secrets in XFlow iOS SDK - Request for Rotation/Invalidation
Status
- Backlog item; not assigned yet.
- Jeff relayed that this is not a priority yet, but asked David to keep the details noted for future reference.
Context
- Related to the remaining Google API Key alerts not included in the previous
PDIAP-11962closure. - If key rotation or invalidation is required, David/XFlow likely needs backend support or clarification because Google API Key rotation is not owned directly by the XFlow iOS side.
Historical Slack Context
- October 2025 Slack context describes
PDIAP-11961as the request for rotation/invalidation of active exposed Google API keys. - The active Google API keys were documented as still valid/in use by the service, so they were intentionally separated from inactive-secret closure evidence.
PDIAP-11962was created as the second-phase closure story to run afterPDIAP-11961invalidation/rotation work completed.- Earlier investigation noted that the API key appeared in a service response and that GitHub was flagging the old commit where the key had been hard-coded and later removed.