From dc50b856fd650dfc801cc9f2f16120dcbbf4f78e Mon Sep 17 00:00:00 2001 From: npeter83 Date: Sun, 25 Oct 2026 17:35:20 +0100 Subject: [PATCH] chore(security): gitleaks knows the public InnerTube key and a fixture's page cursors are no secrets --- .gitleaksignore | 8 ++++++++ backend/app/youtube/innertube.py | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 .gitleaksignore diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 00000000..2554f3dd --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,8 @@ +# gitleaks false positives, one fingerprint per finding (commit:file:rule:line). Each says why it is no secret. +# +# YouTube's public WEB InnerTube key: embedded in every youtube.com results page, read live and cached; +# this constant is only the fallback (backend/app/youtube/innertube.py). +8b37c470ba5d11c45757f0b2e62d660b782e816d:backend/app/youtube/innertube.py:gcp-api-key:23 +# A recorded watch-next page's continuation cursors (continuationCommand.token): page pointers, not credentials. +8b37c470ba5d11c45757f0b2e62d660b782e816d:backend/tests/fixtures/innertube_next_first.json:generic-api-key:768 +8b37c470ba5d11c45757f0b2e62d660b782e816d:backend/tests/fixtures/innertube_next_first.json:generic-api-key:792 diff --git a/backend/app/youtube/innertube.py b/backend/app/youtube/innertube.py index ec6316d8..9c1b8318 100644 --- a/backend/app/youtube/innertube.py +++ b/backend/app/youtube/innertube.py @@ -20,7 +20,7 @@ _API_URL = "https://www.youtube.com/youtubei/v1/" _RESULTS_URL = "https://www.youtube.com/results" # Public WEB InnerTube key + a recent client version. These are also embedded in every results # page; we fetch the live pair once and cache it, falling back to these constants. -_FALLBACK_KEY = "AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8" +_FALLBACK_KEY = "AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8" # gitleaks:allow -- the public WEB key, in every results page _FALLBACK_CLIENT_VERSION = "2.20240101.00.00" _HEADERS = {