AntFleet

Disagreement · 4c349ef3-anthropic-4

Misleading comment: env var section claims secrets are absent but other sensitive risk-config is committed

solo Opus
repo 703f69ec·PR #3·reviewed 5 days ago

Opus finding

Misleading comment: env var section claims secrets are absent but other sensitive risk-config is committed

lowdocs-gapmedium
  • infra/stack.py:26-35
  • infra/stack.py:95-100
The docstring promises a clear separation (secrets via console), but the comment near the environment dict reveals that `update-function-configuration` is run post-deploy with a local file — meaning each `cdk deploy` will overwrite production secrets with whatever CDK thinks the environment should be, since CDK considers env vars desired-state. This is an operational footgun that the docstring obscures.

Recommendation

Either source secrets from Secrets Manager / SSM Parameter Store directly in the stack, or document explicitly that every `cdk deploy` requires re-running the env-restore step. Better: stop drift by managing secrets in IaC.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.

← back to all disagreementsview public receiptssee unanimous findings + anatomies →
Tweet ↗