security: redact the user's own stored API keys by exact match
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 30/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
Research direction
Start with redactSecrets in src/main/tools/redact.ts, then the app log's redact function and streamRedactor, to see where existing redaction runs and where a key split across chunks would slip through. Settings key loading in the main process is the source for the exact-match list, which must stay out of the renderer. Done means unit tests with a synthetic stored key in an unknown format pass for tool results, two-chunk streamed output and a log entry, while ordinary text is unchanged.
Written by the indexing model from the issue text.
Description
Follow-up to #153.
Today
redactSecrets (src/main/tools/redact.ts) and the app log's redact recognize known token formats, URL passwords and credential-named .env lines. A key in a format none of them know reaches the model, the transcript and saved chats.
Proposal
Also replace exact occurrences of the keys the user saved in Settings (Anthropic, OpenAI, OpenRouter, search keys), which catches any format for the secrets Patch itself holds:
- The main process already has the decrypted keys; build the list when they change, never send it to the renderer.
- Skip values shorter than ~16 characters to avoid redacting ordinary text.
- Apply in tool results, streaming command output (
streamRedactor, including a key split across chunks) and the app log.
Test
Unit tests with a synthetic stored key in an unknown format: redacted in a tool result, in streamed output split across two chunks, and in a log entry; ordinary text unchanged.
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- Avg merge
- 5h 28m
- Merged PRs (30d)
- 24
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PierrunoYT/patch
-
enhancement priority: medium security severity: low
Difficulty 5/5 Over a week Newbie friendliness 12/100
PierrunoYT/patch#262 ·
Maintainers usually reply within 1 day
-
platform: macos priority: medium security severity: low tests
Difficulty 4/5 3-5 days Newbie friendliness 15/100
PierrunoYT/patch#257 ·
Maintainers usually reply within 1 day
-
bug platform: macos priority: medium security severity: high
Difficulty 3/5 1-2 days Newbie friendliness 35/100
PierrunoYT/patch#232 · 1 comment ·
Maintainers usually reply within 1 day
-
enhancement platform: windows priority: low severity: low
Difficulty 5/5 Over a week Newbie friendliness 18/100
PierrunoYT/patch#228 ·
Maintainers usually reply within 1 day
-
enhancement platform: windows priority: medium security severity: low
Difficulty 5/5 Over a week Newbie friendliness 14/100
PierrunoYT/patch#227 · 1 comment ·
Maintainers usually reply within 1 day
All issues in PierrunoYT/patch
Similar issues
-
chore v2
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
modelcontextprotocol/servers#5115 ·
Maintainers usually reply within 1 day
-
beginner bug good first issue
Difficulty 1/5 Under an hour Newbie friendliness 85/100
philaconvalley/website#168 ·
Maintainers usually reply within 1 day
-
bug frontend good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
oss-slu/lrda_mobile#294 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
hatchet-dev/hatchet#5179 ·
Maintainers usually reply within 1 day