Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[LAUNCH-E F3, High] Recognise Google API keys (AIza...) in redaction and the published-content check

Closed
  • Is something wrong?
#282 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #336 by @iceboundrock — merged

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security

Research direction

Start with the pattern table in src/autoforge/redaction.py and trace how redact and credential_classes apply patterns; then read the published-content and commit-message checks in src/autoforge/result_parser.py. Add coverage in tests/test_redaction.py and tests/test_result_parser.py, and update docs/security.md and docs/agent-guides/secrets-and-logging.md. Done means the dummy key is redacted and refused across the listed checks, the growth-bound tests hold, and make check passes.

Written by the indexing model from the issue text.

Description

bug

Artifact: implementation-ready security issue, finding F3 of the LAUNCH-E security audit (#257, PR #279). This issue body is the authoritative copy; it was drafted from the audit report in the PR #279 description and is not kept elsewhere. Audited commit: 388ecb3b9d6376f8914054cc06ea5e5caab164da (main); line numbers below are at that commit.

Parent: #255 · Audit: #257 · Audit PR: #279 · Priority: P0 · Gate: 5 (Security) · Blocks: the Public Alpha launch (#255 Gate 5) · Blocked by: nothing

Proposed severity: High (the audit's proposal under #257's rubric; the maintainer's confirmation or change is recorded on #257, not here).

Summary

Google API keys (the AIza prefix followed by 35 URL-safe characters) are recognised neither by redaction.py nor by the published-content check that is built on credential_classes. OpenCode launches inherit GEMINI_* and GOOGLE_* by default, so in a documented configuration an agent that prints its environment puts the key into the launch's stdout.log or stderr.log in clear, and agent-authored text carrying such a key passes the check and can be published on GitHub under the operator's identity.

Evidence (at 388ecb3)

  • src/autoforge/redaction.py (pattern table near lines 44-104): no pattern for the AIza shape; independently re-checked with a dummy value, which redact returns unchanged.
  • src/autoforge/providers.py:1466: OpenCodeProvider.environment_names includes GEMINI_* and GOOGLE_*.
  • src/autoforge/result_parser.py:680-765, :804-830: the published-content and commit-message checks refuse only the classes credential_classes reports.
  • docs/usage.md: the OpenCode environment names. PR #279 discloses the gap in docs/security.md; disclosure does not resolve this issue (#257 acceptance criterion 2).

Required remediation

  1. Add a Google API key class to redaction.py (shape: AIza plus 35 characters of [0-9A-Za-z_-]), so that redact and credential_classes both recognise it, and therefore the published-content check, the payload and Markdown checks and the commit-message check refuse it.
  2. Preserve the bounded-redaction invariants: MAX_GROWTH_FACTOR and the tests that depend on it, idempotence, and no catastrophic backtracking.
  3. Make sure the new class is also matched where F2's word-boundary problem applies once F2 is fixed (do not reintroduce a boundary that an escape defeats).
  4. Update docs/security.md and docs/agent-guides/secrets-and-logging.md to list the class.

Acceptance criteria

  • A dummy AIza key is redacted in run logs, stdout.log/stderr.log, state and CLI output, and is reported by credential_classes.
  • Agent text carrying one is refused by every published-content check and by the commit-message check (refused, not rewritten, as for the other classes).
  • The redaction growth bound and its tests still hold.
  • make check passes.

Tests

  • tests/test_redaction.py: the shape alone, in an assignment (GEMINI_API_KEY=..., GOOGLE_API_KEY=...), in JSON, in a URL query string, and at the start and end of a line; a near-miss (wrong length, wrong prefix) is not redacted.
  • tests/test_result_parser.py: published_text_problem, published_payload_problem, published_markdown_problem and commit_message_problem refuse a dummy key.
  • Use dummy values only; no real credential in any test.

Out of scope

  • The other unrecognised shapes listed under audit M4 (AWS, PEM blocks, gsk_, xai-, npm_, glpat-, hf_); they are the M4 follow-up, #285.
  • Narrowing OpenCode's inherited GOOGLE_* names (audit L2).
Dominant language
Python
Stars
0
Forks
0
Avg merge
5h 57m
Merged PRs (30d)
71

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from iceboundrock/AutoForge

All issues in iceboundrock/AutoForge

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.