rmi-backend/CLEANUP.md

CLEANUP.md — rmi-backend

Audit + cleanup log. Most recent first.

2026-07-02 — bloat + secrets removal

Branch: chore/cleanup-remove-bloat-and-secrets

🚨 SECURITY: removed .secrets/

• .secrets/ghost_session_cookies was committed to main. Content was a Netscape cookie jar.
• CRITICAL ACTION REQUIRED: rotate any cookies/secrets that were in this file.
• The file may have been browsable by anyone with repo read access.
• Added .secrets/ to .gitignore (was missing).

🗑️ Bloat removed

• rmi-frontend/ subtree (~2.7MB) — React app lives in its own repo RugMunchMedia/rmi-frontend
• backend/ subtree (273 files, ~1.7MB) — duplicate scaffold, NOT the source of truth

🚮 Broken files removed

• , r.stdout)... — shell heredoc accident with literal newlines in filename
• 5s}, 7s}, =2.0.0 — fragment files from another shell accident

🛡️ .gitignore hardened

Added patterns for:

• Secrets (.secrets/, *.pem, *.key, *.crt, .env)
• Data blobs (*.zip, *.parquet, *.sqlite, *.duckdb)
• Model weights (*.bin, *.safetensors, *.pt, *.onnx)

Files deliberately NOT removed

These look "extra" but are legit:

• worker.py, main.py, Dockerfile.worker — runtime entry points
• alembic.ini, alembic/ — DB migrations
• ruff.toml, mypy.ini, pytest.ini — lint/type/test config
• safe_deploy.sh, databus_warm_cron.py — ops scripts
• justfile, uv.lock, requirements.txt — modern Python tooling
• rmi_sdk.py, rmi_langchain.py, x402_tool_builder.py — domain modules
• smithery.yaml, huggingface.yaml — service configs
• docker-compose.email.yml — email service config
• supabase/*.sql — Supabase migrations
• PROPRIETARY_REGISTRATION.txt — legal doc
• main.py.bak — backup, consider deleting in future PR
• backend.log — log file, should be ignored (will be cleaned by better .gitignore)

Pre-cleanup size

134MB → ~70MB

Lessons learned

• Pre-commit hooks must include gitleaks (it WAS configured but this file slipped through)
• .secretsallow is an allowlist — anything not on it must be blocked
• Empty/short-lived subtrees should be deleted immediately, not left as legacy
• A CLEANUP.md in each repo prevents this pattern from recurring