Skip to content

0014 — Razorpay credential incident closure

Status: accepted (2026-09-05)

Context

The Razorpay activation commit 25a51b8 (2026-09-01) accidentally included credentials in tracked files:

  • A live Razorpay key pair reached the repository in 25a51b8 and was blanked in eaac5df. A blanking commit does not unpublish: the values remain readable in git history to anyone with a clone.
  • A test-mode Razorpay triplet (key id, key secret, webhook secret) was committed in aim-store-website/.env.development — a tracked file whose header claimed "No secrets here". It has now been emptied, but the same history caveat applies.
  • The same commit also brought in a third-party payment-vendor AI-instruction file as the repo-root CLAUDE.md (since replaced with a real project guide).

ADR-0009 already established the repository's posture: names-only templates in git, rotation over history rewriting.

Decision

  • History is deliberately NOT rewritten, per ADR-0009: the repo has active clones, and rotation — not erasure — is what actually revokes an exposed value.
  • The old live key pair is classified COMPROMISED until the operator confirms it has been rotated (regenerated/deactivated) in the Razorpay dashboard. Until that confirmation, treat it as burnable by anyone with repo access.
  • The committed test-mode triplet must also be rotated. Test keys are not harmless: they authenticate against the same merchant account and can create orders and receive webhooks in test mode.
  • Names-only applies to every tracked env file, not just *.example: .env.development files stay tracked as templates (developers need them), and every credential line in them stays empty. The .gitignore secrets block now documents this explicitly.
  • A repo-wide CI secret scan is being added by a separate workstream and will enforce this mechanically.

No secret value or fragment appears in this record, by design.

Consequences

  • Anyone auditing history will find the exposed values; this record tells them both exposures are treated as compromised and handled by rotation.
  • Rotation is an operator task in the Razorpay dashboard and is tracked as such; until it is confirmed, the incident is contained but not closed.
  • Tracked env templates are now recognised as secret-bearing surfaces; a value appearing in any of them is a defect regardless of the file's header comment.