redact_secrets does not redact modern sk-proj- keys, including OPENAI_API_KEY=sk-proj-…

Open Beginner friendly
  • Is something wrong?
#58,603 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
security

Research direction

Start in codex-rs/secrets/src/sanitizer.rs, where redact_secrets() applies the OPENAI_KEY_REGEX and SECRET_ASSIGNMENT_REGEX patterns. Add a sk-proj-[A-Za-z0-9_-]{20,} pattern alongside the legacy one and check the \b boundary that blocks OPENAI_API_KEY=. Done when unit tests in the existing #[cfg(test)] module, modelled on redacts_supported_bearer_tokens, cover a bare project key, an assigned project key, a short key left unchanged and a legacy key still redacted.

Written by the indexing model from the issue text.

Description

bug
Summary

redact_secrets() in codex-rs/secrets/src/sanitizer.rs does not redact
modern OpenAI project keys. A bare sk-proj-… key, and a key assigned as
OPENAI_API_KEY=sk-proj-…, pass through unchanged into client-facing
command representations, logs and model-bound input, even though the
function is meant to redact secrets on a best-effort basis.

File

codex-rs/secrets/src/sanitizer.rs, redact_secrets().

Current patterns (verbatim):

  • OPENAI_KEY_REGEX = sk-[A-Za-z0-9]{20,}
  • BEARER_TOKEN_REGEX = (?i:\bBearer)[ \t]+[A-Za-z0-9._~+/-]{16,}=*
  • SECRET_ASSIGNMENT_REGEX = (?i)\b(api[_-]?key|token|secret|password)\b(\s*[:=]\s*)(["']?)[^\s"']{8,}
Why it leaks
  1. A project key has the shape sk-proj-<token> with a hyphen after
    proj. sk-[A-Za-z0-9]{20,} needs 20 alphanumeric characters after
    sk-, but it meets proj (4) then - and fails, and there is no
    second sk- to retry from.
  2. The assignment pattern does not save OPENAI_API_KEY=sk-proj-…:
    \b before api fails because the preceding character is _
    (a word character) in OPENAI_API_KEY. The same applies to
    lowercase openai_api_key=….
What already works (so this report is precise)
  • API_KEY=sk-proj-… is redacted by the assignment pattern.
  • Bearer sk-proj-… is redacted by the Bearer pattern.
  • Legacy bare sk-… keys are redacted by the legacy pattern.
Reproduction (fake key shapes only, no real keys)

Verified in Rust, not just by reading the patterns: the verbatim
sanitizer.rs was run in a standalone crate (same regex crate,
existing tests still pass). A new test with fake shapes
(sk-proj- + 48 repeated letters, and OPENAI_API_KEY= / openai_api_key=
with the same fake shape) FAILED before the fix — the input passed
through unchanged — and passes after it. A short sk-proj-abc is
correctly left unchanged.

Note on scope: the full workspace cargo test -p codex-secrets could
not be run in my environment because workspace resolution tries to
fetch an unrelated v8 dependency whose Chromium submodule fetch
times out. The verification above is therefore a standalone replica
of sanitizer.rs with the same regex crate, not a full workspace
test run.

Proposed fix (same file, no refactor)

Add alongside the legacy pattern, applied in redact_secrets():

sk-proj-[A-Za-z0-9_-]{20,}

Keep the legacy sk-[A-Za-z0-9]{20,} unchanged. Add unit tests in
the existing #[cfg(test)] module, mirroring
redacts_supported_bearer_tokens: bare project key,
OPENAI_API_KEY= project key, short key (no redaction), legacy key
(still redacted).

sk-svcacct- keys are deliberately NOT included here, as their
character set was not confirmed for this report.

Dominant language
Rust
Stars
131k
Forks
20.7k
Avg merge
1m
Merged PRs (30d)
997

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openai/codex

All issues in openai/codex

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.