docs(rest-api): redact real-looking credentials and sample data from API specs - #445
Open
shardul-cometchat wants to merge 2 commits into
Open
docs(rest-api): redact real-looking credentials and sample data from API specs#445shardul-cometchat wants to merge 2 commits into
shardul-cometchat wants to merge 2 commits into
Conversation
Swap out sample data in the OpenAPI specs that looked like real personal details with obvious placeholders: - chat-apis.json: Update/Get contact details examples now use the placeholder phone +911111111111 instead of a real-looking number. - management-apis.json: Add Tenant request/response examples now use "Example User" / my-email@example.com, matching the placeholders the file already uses elsewhere, and contactNumber is normalized to 1111111111 across all three examples. - management-apis.json: the Add Tenant response example exposed what look like a genuine authKey and apiKey; replaced with <AUTH_KEY> and <API_KEY>, matching the <API_KEY1> convention used earlier in the file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Follow-up to the contact-details cleanup, covering the rest of the real-looking credentials and phone numbers across the API specs. Credentials replaced with placeholders: - Twilio account SIDs and auth tokens (chat-apis.json, management-apis.json) - Reply-webhook tokens for SendGrid, Intercom and Chatwoot. The Intercom and Chatwoot tokens carried a base64 payload decoding to a real appId, so they were generated against an actual app. - CometChat REST API keys (chat-apis.json, data-import-apis.json). The list-keys example uses <API_KEY1..3> so it still reads as three keys. - Call session wsChannel.secret (chat-apis.json) Phone numbers standardized to +12125550123, which falls in the 555-0100 to 555-0199 block that NANP permanently reserves for fictional use: - Twilio sender numbers, SMS payload samples, contactNumber examples and the malformed fromMobileNo in the SMS extension settings. - contactNumber examples move from bare 10-digit strings to E.164, since those fields feed SMS notifications and need a country code. - The +91 contact-details examples are left alone so they keep matching the field description, which cites +91 for India. Redaction stops further leakage but does not undo it: these values remain in git history and have been served by the docs site. Any that are still live should be rotated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
shardul-cometchat
changed the title
ketanyekale
approved these changes
Jul 28, 2026
mathews-cometchat
approved these changes
Jul 28, 2026
siva-cometchat
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The OpenAPI specs contained example values that looked like real credentials, personal details and phone numbers rather than obvious placeholders. This replaces all of them.
Found by scanning the whole repo. Worth stating what the scan did not find, since that bounds the exposure: no AWS/Google/Slack/GitHub/Stripe keys, no JWTs, no private keys or certificates, no tracked
.env/.pem/serviceAccountfiles, and no real personal email addresses. Everything below is confined to example values in the API specs and two SMS docs pages.Personal details
management-apis.json— the Add Tenant request and response examples used a real person's name and@cometchat.comaddress. Replaced withExample User/my-email@example.com/somePassword#!, matching the placeholders that file's own "Request Example" block already uses.Third-party credentials
chat-apis.json(5 each) andmanagement-apis.json(1 each) →<TWILIO_ACCOUNT_SID>/<TWILIO_AUTH_TOKEN>. Some had been hand-mangled previously (non-hex characters, wrong length), but they still read as live credentials.chat-apis.json), Intercom (3) and Chatwoot (3,management-apis.json) →<REPLIES_WEBHOOK_TOKEN>. These are bearer credentials embedded in URLs. The Intercom and Chatwoot tokens carry a base64 segment that decodes cleanly to{"appId":"212663ddb7a2a66b"}, so they were generated against a real app rather than invented.CometChat credentials
chat-apis.json, 1 indata-import-apis.json→<API_KEY>. The list-keys endpoint uses<API_KEY1>/<API_KEY2>/<API_KEY3>so the example still reads as three distinct keys.wsChannel.secretinchat-apis.json(2) →<WS_CHANNEL_SECRET>.Phone numbers
Standardized to
+12125550123, which sits in the555-0100–555-0199block that NANP permanently reserves for fictional use, so it can never be assigned to anyone:chat-apis.json)sms-templates.mdx, 2 insms-custom-providers.mdx)contactNumberexamples (10 inchat-apis.json, 3 inmanagement-apis.json)fromMobileNoin the SMS extension settings, which was a malformed 9-digit numberThe
+91examples on the contact-details endpoint are deliberately left as-is, so they keep matching that field's description ("phone number with country code (Ex: +1 for US, +91 for India, etc.)").Related Issue(s)
N/A
Type of Change
Checklist
Additional Information
Important
Redaction is not remediation. Every value removed here remains in this repository's git history and has been served publicly by the docs site. If any of these are still live — particularly the Twilio credentials, the Intercom/Chatwoot/SendGrid webhook tokens, and the REST API keys — they need to be rotated at the source. This PR only stops further leakage.
Two notes on scope:
contactNumberexamples changed from bare 10-digit strings to E.164 with a country code. That is a format change, not just a value swap, and it is intentional: those fields feed SMS notifications, which require a country code.All three specs were validated as parseable JSON after the edits. No schema, endpoint or field-description changes, so there is no behavioral impact on the rendered API reference beyond the displayed sample values.
Screenshots (if applicable)
N/A
🤖 Generated with Claude Code