IB Keelwise

OPEN · Schwab OAuth credentials exposed in GitHub pull-request refs · [SEC-2026-07-05-ENV]

A .env file was committed on 2026-07-05 in commit 7b5f85d, containing SCHWAB_APP_KEY, SCHWAB_APP_SECRET, SCHWAB_CALLBACK_URL and SCHWAB_TOKEN_PATH. It is NOT present on main or on any branch, and .env is correctly gitignored. It remains reachable on GitHub through refs/pull/1/head and refs/pull/2/head. Pull-request refs are not branches, so git filter-repo and force-push cannot remove them. Repository is private and secret scanning is disabled. CONFIRMED EXPOSED 2026-09-21: the operator regained developer-portal access and compared the live App Details pair against the committed pair. They are identical, so the credentials in use are the leaked ones. ROTATION IS NOT POSSIBLE. The Schwab developer portal offers no key or secret regeneration and no app deletion; deactivation is the only control, and retail individuals are limited to one app per API. Schwab support's stated position is that app keys contain no personal information and cannot be used to reach brokerage account details, and that changing them requires their internal team to deactivate the app so a NEW developer-portal account can be registered under a DIFFERENT email address. Community-reported, not Schwab documentation -- see https://www.reddit.com/r/Schwab/comments/1pqxme7/schwab_api_cannot_delete_an_app_or_rotate/ -- but consistent with the controls visible in the portal UI. Worth one direct confirmation to TraderAPI@schwab.com before acting on it. These are OAuth app credentials, not account credentials: they cannot reach funds without a completed Schwab login and a listener on the callback URL https://127.0.0.1:8182. NO IBKR CREDENTIAL HAS EVER BEEN COMMITTED TO THIS REPOSITORY. An earlier version of this panel claimed live IB credentials were exposed; that claim was false and cost operator time on 2026-09-17.

Remedy: The original remedy -- rotate the key and secret, or have Schwab delete the app -- is impossible; see detail. The fix is therefore to remove the place the pair is readable rather than to change the pair. PRIMARY: ask GitHub Support to purge refs/pull/1/head and refs/pull/2/head. Targeted, free, and it preserves the app's hard-won Ready For Use status. FALLBACK: push every branch to a fresh private repository and delete this one. PR refs die with the repository. Cost is the loss of pull-request history, which is the written record of why this code is the way it is. LAST RESORT: have Schwab deactivate the app and register a new developer-portal account under a different email. Zero residual risk, highest cost -- a new account, re-approval that has been reported to take weeks, and the loss of an app that took until 2026-09-21 to reach Ready For Use. DO NOT rewrite git history for this -- it cannot fix PR refs. HARDENING that costs nothing and applies regardless: run the callback listener only during the OAuth flow, never leave port 8182 listening. AND NOTE: once the OAuth flow is completed, the resulting token file is more sensitive than the app key, because it DOES reach the account. It must live outside the repository alongside .env, and must never be committed. No longer blocked on Schwab portal access -- that was resolved 2026-09-21, which is why this item moved from BLOCKED to OPEN. Not required for any IBKR paper work.

Last verified: 2026-09-21