security(incident-log): redact full token values from F1088 incident report

[HongmingWang-Rabbit]

[Molecule-Platform-Evolvement-Manager]

Background

EnterOS-AI/enter-os-core#2109 shipped an org-wide secret-scan workflow. The first repo it caught a real match in was THIS one — content/docs/incidents/INCIDENT_LOG.md.

The F1088 incident report documented three production credentials that leaked via molecule-core PR #1098 (commit d513a0c), and then INCLUDED THEM IN PLAINTEXT IN THE DOCUMENTATION ITSELF. The incident report became a secondary leak surface — and the docs repo is publicly indexed.

Token status (per the report's own Blast Radius table)

Credential	Status
MiniMax sk-cp-...KVw	Revoked / endpoint inactive (404)
GitHub PAT github_pat_...hsIJLIL	Revoked (confirmed 401)
Admin token HlgeMb8...ShARE=	Treated as active, rotation pending

Two of three are confirmed revoked. The third (admin token) is still pending rotation per the report itself.

What this PR does

• Replaces the full values in the Credentials Exposed table with the short-suffix convention already used in the Blast Radius table (lines 134-137 before this change). Audit trail preserved.
• Replaces the BFG creds.txt example block with placeholders + a note pointing operators to the internal incident ticket if the procedure is ever revived.
• Adds an explicit redaction note explaining what changed and why.

What this PR does NOT change

• Full values still exist in molecule-core git history per F1088's explicit closure decision (no BFG scrub required, no active public forks).
• This PR is additive defense — removes one more visible copy. Doesn't change the incident closure status.

Asks for the user (separate from this PR)

1. Confirm admin token rotation status. F1088 marked it 'treated as active until proven otherwise' on the original incident date. If it's still un-rotated, that's a separate item to handle.
2. Decide whether to rotate even the confirmed-revoked tokens as defense-in-depth. Probably not — but worth a moment's thought now that the secret-scan rollout has surfaced the public-visibility angle.

Test plan

• Local git grep confirms no full token values remain in the working tree
• CI green — the secret-scan workflow on this PR should now PASS (the only added lines are the redaction note + short-suffix references that don't match the patterns)
• Post-merge: re-run org-wide secret scan on a fresh PR opened against this repo to confirm zero matches

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 27, 2026 2:37am

[HongmingWang-Rabbit]

[Molecule-Platform-Evolvement-Manager]

Superseded by #96 — the scrub commit was merged into the workflow-enrollment branch so the secret-scan check sees both the workflow file AND the scrubbed INCIDENT_LOG in one diff. Avoids the catch-22 where #97 had no scan to validate it (branched before #96 added the workflow) and #96 couldn't pass scan until the F1088 tokens were scrubbed.

File changes preserved at a29db81 on chore/enroll-secret-scan.