chore(express): remove leaked test wallet credentials - #9501

Summary

Removes leaked testnet wallet credentials that had been shipped in the public bitgo/express Docker image (and @bitgo/express npm package) since 2022, and sanitizes the docs/tests that referenced them.

Ticket: https://linear.app/bitgo/issue/WCI-1293/remove-leaked-test-wallet-credentials-from-bitgo-express

Background

An external Bugcrowd researcher flagged that modules/express/encryptedPrivKeys.json — a real (testnet-only) encrypted private key fixture — was checked into this repo and shipped in the published Docker image. The corresponding wallet passphrase (wDX058%c4plL1@pP) was documented in plaintext in EXTERNAL_SIGNER.md, unlocking both wallet IDs referenced there:

• 61f039aad587c2000745c687373e0fa9
• 61fb21819c54dd000755f8de3a18e46f

Root cause: The file was added in 2022 (PRs #1988, #2069) and the root .dockerignore never excluded it, so COPY --from=builder /tmp/bitgo/modules/express /var/bitgo-express/ in the Dockerfile baked it into every image tag. The same file was also shipped via npm because modules/express/.npmignore didn't exclude it and package.json has no files allowlist.

Scope of exposure: testnet-only, no real funds at risk, originating account already terminated.

Changes

Removals / sanitization

• Delete modules/express/encryptedPrivKeys.json (the fixture with the real encrypted key).
• Sanitize modules/express/EXTERNAL_SIGNER.md:
  • Replaced the two real encrypted private keys with / placeholders.
  • Replaced the plaintext passphrase examples with <YOUR_WALLET_PASSPHRASE>.
• Sanitize tests — replaced hardcoded 61f039aad587c2000745c687373e0fa9, 61fb21819c54dd000755f8de3a18e46f, and wDX058%c4plL1@pP with synthetic values:
  • test/unit/clientRoutes/signPayload.ts — generates the encrypted fixture at runtime via bitgo.encrypt({ ..., encryptionVersion: 1 }) in before(), uses a synthetic wallet ID and passphrase.
  • test/unit/clientRoutes/externalSign.ts — same pattern.
  • test/unit/bitgoExpress.ts — synthetic wallet ID in validPrvJSON.

Fixture-file dependency removed from tests

• test/unit/typedRoutes/{coinSign,ofcExtSignPayload,generateShareTSS}.ts used to read/write the checked-in encryptedPrivKeys.json at test setup. Refactored to write a temporary file under os.tmpdir() with a unique name (encryptedPrivKeys--.json) and delete it in after(). Removes the runtime dependency on the deleted file entirely.

Safety net

• Root .gitignore — added encryptedPrivKeys.json and modules/express/encryptedPrivKeys.json so that if a user runs fetchEncryptedPrivKeys.ts (the utility that legitimately produces this file locally with their own creds), git won't accidentally track it.

Notes on the encryption version

bitgo.encrypt() now defaults to v2 (Argon2id + AES-256-GCM) envelopes. The original hardcoded fixture was v1 (SJCL), and one existing test (externalSign.ts:1270) asserts the encrypted output starts with {"iv":"..." — the v1 envelope shape. To preserve that assertion (and keep the diff scoped to just the credential rotation), the runtime bitgo.encrypt(...) calls in the affected before() hooks explicitly pass encryptionVersion: 1. Updating that assertion / migrating to v2 fixtures is a separate concern.

Verification

• grep for leaked wallet IDs (61f039..., 61fb21...) and passphrase (wDX058...) across the repo → 0 matches.
• Local unit-test run of test/unit/clientRoutes/signPayload.ts and test/unit/clientRoutes/externalSign.ts → 1919 passing, 0 failing.
• No new TypeScript errors introduced.