continuedev / continuedev/continue
storing api keys in plain text
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 36k
- Forks
- 5.4k
- PR merge metrics
- No merged PRs in 30d
Description
Validations
- I believe this is a way to improve. I'll try to join the Continue Discord for questions
- I'm not able to find an open issue that requests the same enhancement
Problem
I don't like that all the API keys are stored in plain text in a JSON file at the user root. I know that this is required for VSCode, and every other plugin that uses API has to do this. It just doesn't sit right with me.
Solution
At the very least, put a .gitignore at the root of .continue to make sure config.json doesn't get indexed. It may also be possible to write external scripts that encrypt the config.json if the user wants to be security-conscious.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the user-root .continue/config.json file is created and how API keys are stored. The issue proposes first preventing config.json from being indexed with a .gitignore, with optional encryption as a broader possibility. Done should include a clearly agreed protection approach and verification that stored keys are not exposed through the intended workflow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, vscode
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100