PR Custody

fix: remove live GitHub token fixture

@kaavee315checks n/achecks…codex/propose-fix-for-oauth-token-vulnerability → master1 files · +2 −2updated 1w ago

▸Description · 1 noise

A connected-account fixture contained an encrypted GitHub OAuth token that can be decrypted using the CI ENCRYPTION_KEY, exposing a live-looking provider token and broad scopes. This change removes the sensitive, decryptable credential from the repository.

Replaced the ciphertext for the first connected-account in packages/db/prisma/fixtures/connectedAccounts.ts with a synthetic encrypted payload that decrypts to an invalid placeholder token and reduced scopes.
Updated the fixture comment to explicitly prohibit committing real provider tokens.
No runtime behavior or API logic was changed beyond the test fixture content.

Ran the package unit tests with pnpm --filter @composio/db test, which passed (1 test file, 5 tests passed).
Performed an automated decryption check script against the new fixture to verify it decrypts to the synthetic placeholder token and expected reduced scope (script returned success).

▸ 1 bot/status comment hidden

@github-actions[bot]1w ago

Based on git blame analysis of 1 file(s):

Based on git history, anshugarg15 or lingalarahul7 would be good reviewer(s) for this PR.

🤖 Based on git blame with recency weighting (recent edits count more).

loading diff…