binary-husky / binary-husky/gpt_academic
Potential Sensitive API Key Leakage Detected
- Dominant language
- Python
- Stars
- 71.3k
- Forks
- 8.3k
- PR merge metrics
- No merged PRs in 30d
Description
This issue is created due to exposed sensitive API keys found during scanning.
### Detected Vulnerabilities:
- **File**: `cloned_repos/gpt_academic/config.py`
- **Line 10**: # [step 1]>> API_KEY = "sk-123456789xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx123456789"。极少数情况下,还需要填写组织(格式如org-123456789abcdefghijklmno的),请向下翻,找 API_ORG 设置项
- **Line 264**: HUGGINGFACE_ACCESS_TOKEN = "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"
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.
- **File**: `cloned_repos/gpt_academic/docker-compose.yml`
- **Line 36**: API_KEY: ' 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 '
- **Line 87**: API_KEY: ' sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx '
- **Line 115**: API_KEY: ' sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx '
- **Line 152**: API_KEY: ' sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx,fkxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx '
- **Line 186**: API_KEY: ' sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx '
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.
- **File**: `cloned_repos/gpt_academic/shared_utils/config_loader.py`
- **Line 15**: set API_KEY=sk-j7caBpkRoxxxxxxxxxxxxxxxxxxxxxxxxxxxx
- **Line 21**: set GPT_ACADEMIC_API_KEY=sk-j7caBpkRoxxxxxxxxxxxxxxxxxxxxxxxxxxxx
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.
- **File**: `cloned_repos/gpt_academic/tests/test_key_pattern_manager.py`
- **Line 18**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
- **Line 30**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_xxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxx"
- **Line 32**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxx_xxxxxxxxxxxx_xxxxx-xxxxxxxxxxxxxxxxxxxx"
- **Line 34**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxx-xxxxxxxxxxxxxxx_xxxxxxxxxxxx_xxxxx-xxxxxx-xxxxxxxxxxxxx"
- **Line 36**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxx-xxxxxxxxxxxxxxx_xxxxxxxxxxxx_xxxxx-xxxxxxxxxxxxxxxxxx"
- **Line 38**: key = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxx-xxxxxxxxxxxxxxx_xxxxxxxxxxxx_xxxxx-xxxxxxxxxxxxxxxxxxxxx"
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.
- **File**: `cloned_repos/gpt_academic/docs/use_vllm.md`
- **Line 29**: API_KEY = "sk-123456789xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx123456789"
- **Suggested Fix**: Replace the leaked key with a secure reference or environment variable.
Contributor guide
No contributing guide indexed for this repository
Research direction
Review the listed locations in config.py, docker-compose.yml, shared_utils/config_loader.py, tests/test_key_pattern_manager.py, and docs/use_vllm.md. Start by checking each reported value and the existing key-pattern tests, then replace exposed values with secure references or environment variables. Done means no sensitive keys remain in those locations and the relevant tests still pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker-compose, python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100