binary-husky / binary-husky/gpt_academic

Potential Sensitive API Key Leakage Detected

Open
#2,040 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
71.3k
Forks
8.3k
PR merge metrics
No merged PRs in 30d

Description

This issue is created due to exposed sensitive API keys found during scanning.

### Detected Vulnerabilities:
- **File**: `cloned_repos/gpt_academic/config.py`
- **Line 10**: # [step 1]>> API_KEY = "sk-123456789xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx123456789"。极少数情况下,还需要填写组织(格式如org-123456789abcdefghijklmno的),请向下翻,找 API_ORG 设置项
- **Line 264**: HUGGINGFACE_ACCESS_TOKEN = "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"
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.

- **File**: `cloned_repos/gpt_academic/docker-compose.yml`
- **Line 36**: API_KEY: ' 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 '
- **Line 87**: API_KEY: ' sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx '
- **Line 115**: API_KEY: ' sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx '
- **Line 152**: API_KEY: ' sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx,fkxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx '
- **Line 186**: API_KEY: ' sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx '
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.

- **File**: `cloned_repos/gpt_academic/shared_utils/config_loader.py`
- **Line 15**: set API_KEY=sk-j7caBpkRoxxxxxxxxxxxxxxxxxxxxxxxxxxxx
- **Line 21**: set GPT_ACADEMIC_API_KEY=sk-j7caBpkRoxxxxxxxxxxxxxxxxxxxxxxxxxxxx
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.

- **File**: `cloned_repos/gpt_academic/tests/test_key_pattern_manager.py`
- **Line 18**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
- **Line 30**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_xxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxx"
- **Line 32**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxx_xxxxxxxxxxxx_xxxxx-xxxxxxxxxxxxxxxxxxxx"
- **Line 34**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxx-xxxxxxxxxxxxxxx_xxxxxxxxxxxx_xxxxx-xxxxxx-xxxxxxxxxxxxx"
- **Line 36**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxx-xxxxxxxxxxxxxxx_xxxxxxxxxxxx_xxxxx-xxxxxxxxxxxxxxxxxx"
- **Line 38**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxx-xxxxxxxxxxxxxxx_xxxxxxxxxxxx_xxxxx-xxxxxxxxxxxxxxxxxxxxx"
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.

- **File**: `cloned_repos/gpt_academic/docs/use_vllm.md`
- **Line 29**: API_KEY = "sk-123456789xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx123456789"
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.

Contributor guide

No contributing guide indexed for this repository

Research direction

Review the listed locations in config.py, docker-compose.yml, shared_utils/config_loader.py, tests/test_key_pattern_manager.py, and docs/use_vllm.md. Start by checking each reported value and the existing key-pattern tests, then replace exposed values with secure references or environment variables. Done means no sensitive keys remain in those locations and the relevant tests still pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker-compose, python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.