API key possibly leaked in generated quick-start.sh script #11

New issue

Closed

opened 2026-05-09 05:18:48 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 05:18:48 +00:00

Owner

Severity: Medium (information disclosure risk)

File: src/components/wizard/SummaryStep.tsx lines 248-252

Issue: The generateSetupCommands() function generates a quick-start.sh script that contains:

export ${state.provider.toUpperCase()}_API_KEY="${state.apiKey ? 'your-api-key' : 'sk-...'}"

While the code uses the literal string "your-api-key" instead of the actual key, this is still risky:

If the user edits and re-runs the script without replacing the placeholder, they might commit a misleading "your-api-key" string to their repository
A future code change could accidentally switch to interpolating the real state.apiKey
The pattern encourages embedding credentials in shell scripts, which is a security anti-pattern

Recommendation: Use environment variable prompts or a .env.example file pattern instead of embedding even placeholder credentials in the generated script.

**Severity:** Medium (information disclosure risk) **File:** `src/components/wizard/SummaryStep.tsx` lines 248-252 **Issue:** The `generateSetupCommands()` function generates a `quick-start.sh` script that contains: ```typescript export ${state.provider.toUpperCase()}_API_KEY="${state.apiKey ? 'your-api-key' : 'sk-...'}" ``` While the code uses the literal string "your-api-key" instead of the actual key, this is still risky: 1. If the user edits and re-runs the script without replacing the placeholder, they might commit a misleading "your-api-key" string to their repository 2. A future code change could accidentally switch to interpolating the real `state.apiKey` 3. The pattern encourages embedding credentials in shell scripts, which is a security anti-pattern **Recommendation:** Use environment variable prompts or a `.env.example` file pattern instead of embedding even placeholder credentials in the generated script.