| # CLEANUP.md — rmi-backend |
|
|
| > Audit + cleanup log. Most recent first. |
|
|
| ## 2026-07-02 — bloat + secrets removal |
|
|
| **Branch**: `chore/cleanup-remove-bloat-and-secrets` |
|
|
| ### 🚨 SECURITY: removed `.secrets/` |
| - `.secrets/ghost_session_cookies` was committed to main. Content was a Netscape cookie jar. |
| - **CRITICAL ACTION REQUIRED: rotate any cookies/secrets that were in this file.** |
| - The file may have been browsable by anyone with repo read access. |
| - Added `.secrets/` to `.gitignore` (was missing). |
|
|
| ### 🗑️ Bloat removed |
| - `rmi-frontend/` subtree (~2.7MB) — React app lives in its own repo `RugMunchMedia/rmi-frontend` |
| - `backend/` subtree (273 files, ~1.7MB) — duplicate scaffold, NOT the source of truth |
|
|
| ### 🚮 Broken files removed |
| - `, r.stdout)...` — shell heredoc accident with literal newlines in filename |
| - `5s}`, `7s}`, `=2.0.0` — fragment files from another shell accident |
|
|
| ### 🛡️ .gitignore hardened |
| Added patterns for: |
| - Secrets (`.secrets/`, `*.pem`, `*.key`, `*.crt`, `.env`) |
| - Data blobs (`*.zip`, `*.parquet`, `*.sqlite`, `*.duckdb`) |
| - Model weights (`*.bin`, `*.safetensors`, `*.pt`, `*.onnx`) |
|
|
| ## Files deliberately NOT removed |
| These look "extra" but are legit: |
| - `worker.py`, `main.py`, `Dockerfile.worker` — runtime entry points |
| - `alembic.ini`, `alembic/` — DB migrations |
| - `ruff.toml`, `mypy.ini`, `pytest.ini` — lint/type/test config |
| - `safe_deploy.sh`, `databus_warm_cron.py` — ops scripts |
| - `justfile`, `uv.lock`, `requirements.txt` — modern Python tooling |
| - `rmi_sdk.py`, `rmi_langchain.py`, `x402_tool_builder.py` — domain modules |
| - `smithery.yaml`, `huggingface.yaml` — service configs |
| - `docker-compose.email.yml` — email service config |
| - `supabase/*.sql` — Supabase migrations |
| - `PROPRIETARY_REGISTRATION.txt` — legal doc |
| - `main.py.bak` — backup, consider deleting in future PR |
| - `backend.log` — log file, should be ignored (will be cleaned by better .gitignore) |
|
|
| ## Pre-cleanup size |
| 134MB → ~70MB |
|
|
| ## Lessons learned |
| - Pre-commit hooks must include gitleaks (it WAS configured but this file slipped through) |
| - `.secretsallow` is an allowlist — anything not on it must be blocked |
| - Empty/short-lived subtrees should be deleted immediately, not left as legacy |
| - A `CLEANUP.md` in each repo prevents this pattern from recurring |
|
|
