I've disabled the oauth consumer (0a73e346a40b07262b6e36bdba01cba4), to make it impossible to auth any requests via leaked information.

Looks like that's a really old file from when PAWS was inside Toolforge. I've set the file to read-only and will change the database password.

I've also set up a separate database for PAWS that this is probably time to switch it for.

I set all files in the Toolforge version of /data/project/paws to be user and group read only just so that's done.

Working on completing T267683, which already uses a different password, in order to make rotating the password for toolsdb simpler.

PAWS is now running on a separate Trove database (committing the change to git shortly), and I have rotated the credentials for ToolsDB (which it will no longer be using anyway).

The PR is https://github.com/toolforge/paws/pull/82, but it's already deployed. I think that closes this up.

@Urbanecm @Bstorm - Can I (or anyone really) make this task public now? I didn't see any problematic data in the task description or comments.

I have no objection, but I am interested if @Urbanecm agrees I covered everything that needs doing first.

In T289180#7293008, @Bstorm wrote:

I have no objection, but I am interested if @Urbanecm agrees I covered everything that needs doing first.

Was the (now defunct) ToolsDB database dropped as well? I think that should be done as well. If I didn't miss anything, the credentials should be void by now, but I still feel like keeping unnecessary credentials around is a bad thing.

Thanks for fixing this quickly @Bstorm.

No, but I can drop the tables now.

Database is dropped.

Thanks! I've published the task.