Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

refactor(vault-pinning): use the broker and remove NEXT_PUBLIC provider credentials

Open
  • Is something wrong?
#46 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
67/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript, next.js
Domain
backend, security

Research direction

Start by reading the Pinata and Lighthouse adapters in services/*.ts and the vault pinning tests in frontend/tests/vault-pinning.test.mjs; check the broker routes from dependency #45. Update the adapters, tests, and docs, and add the production build credential check. Done means the NEXT_PUBLIC_* reads are removed, build output contains no provider credential, and the vault pinning tests pass against the broker.

Written by the indexing model from the issue text.

Description

enhancement helia storage tier-1

Summary

Point the Pinata and Lighthouse adapters at the broker routes and delete the browser-side credentials.

Estimated size: S

Motivation

Finishes the credential-safety work started by the broker.

Current state in this repo

  • NEXT_PUBLIC_PINATA_JWT and NEXT_PUBLIC_LIGHTHOUSE_KEY are read in services/*.ts; frontend/tests/vault-pinning.test.mjs sets NEXT_PUBLIC_LIGHTHOUSE_KEY.

Proposal

  • Adapters call the broker routes through fetch.
  • Remove the NEXT_PUBLIC_* reads, update tests and docs.
  • Add a short upgrade note: any provider key that was ever exposed as NEXT_PUBLIC_* should be rotated.

Acceptance criteria

  • git grep NEXT_PUBLIC_PINATA NEXT_PUBLIC_LIGHTHOUSE returns nothing.
  • The production build output contains no provider credential.
  • Existing vault-pinning tests pass against the broker.

Dependencies

  • #45

Testing plan

  • Update frontend/tests/vault-pinning.test.mjs; add a build-output check for the credential strings.

Part of #43. Ground rules for the content layer: no secrets in the repo, content-layer failures must never block or discard quantum execution, and tests and docs ship with every PR.

Dominant language
Python
Stars
2
Forks
4
Avg merge
5h 19m
Merged PRs (30d)
11

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from QMeshPy/distributed-quantum

All issues in QMeshPy/distributed-quantum

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.