Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

[FR] API Keys Management and Security Controls

Aberta
  • Algo errado?
#518 1 comentário 2 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
20/100
Tipo de issue
Funcionalidade
Clareza
Precisa de esclarecimento
Status de atividade
Estagnada
Stack de tecnologia
typescript
Domínio
authentication, authorization, backend-api-design, security

Direção de pesquisa

The issue names no files, tests, or entry points. Start by locating the existing API-key, role/permission, and audit-log implementations, then clarify which single control should be scoped first. Done requires agreed acceptance criteria for the selected management or security feature, including its permissions and audit behavior.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Feature

API Keys Management and Security Controls

Description

We appreciate using SourceBot EE for its integration with LLMs and advanced code search capabilities. However, we have significant security concerns around API key management that increase the risk of unauthorized data access, exfiltration, and could lead to supply chain compromission.

Note: SourceBot already provides audit logs (see docs), but we request enhanced coverage for API key management and alerting hooks.

Context and Security Concerns

Current API key management in SourceBot presents several critical security issues:

  • API key misuse – a leaked SOURCEBOT_API_KEY grants full access to all MCP tools, without granular restrictions.
  • Visibility of API keys – admins cannot view or centrally monitor all keys created by users, making leaks and misuse harder to detect.
  • No expiration or rotation – API keys persist indefinitely, increasing the blast radius of any compromise.
  • Lack of granular permissions – all API keys have the same level of access regardless of user role or need.
  • No approval workflows – sensitive permissions can be granted without oversight.

These concerns mean that controlling API key creation and usage is critical to prevent unintentional data exposure and maintain least privilege.

Requested Features

We request the following features to improve API key management and security:

1. Admin Dashboard for API Keys
  • View all API keys with metadata (owner, creation date, last usage, permissions).
  • Ability to revoke keys centrally.
  • Expiration & rotation: support for short-lived keys with automatic rotation.
  • Real-time monitoring of key usage patterns.
2. RBAC Control on API Key Creation
  • Restrict key generation by role.
  • Add approval workflows for sensitive permissions.
  • Require justification for high-privilege key creation.
3. Granular Admin Rules & Scopes
  • Define which roles/people can create keys.
  • Restrict keys to specific MCP tools (e.g., allow list_repos but not get_file_source).
  • Enforce repository and file-level access policies.
  • Time-based access controls (e.g., keys only valid during business hours).
4. Enhanced Auditability & Alerting
  • Extend existing audit logs with detailed API key usage events.
  • Provide alerting hooks for suspicious activity (e.g., unusual usage patterns, bulk operations).
  • Integration with SIEM systems for centralized monitoring.
5. Key Lifecycle Management
  • Automatic key rotation based on organizational policies.
  • Key expiration notifications and renewal workflows.
  • Emergency key revocation capabilities.
  • Key usage analytics and reporting.

Security Benefits

Implementing these features would provide:

  • Reduced attack surface through granular permissions and time-limited access
  • Better incident response with centralized key management and monitoring
  • Compliance support for organizations requiring strict access controls
  • Risk reduction through approval workflows and usage monitoring
  • Operational efficiency with automated rotation and lifecycle management

Conclusion

Robust API key management is essential for secure SourceBot deployment in enterprise environments. The current all-or-nothing approach creates unnecessary risk and makes it difficult to maintain least privilege principles. We request these features to enable secure, auditable, and manageable API key usage across the platform.

Linguagem predominante
TypeScript
Estrelas
3.9k
Forks
374
Merge médio
22h 33min
PRs com merge (30d)
39

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de sourcebot-dev/sourcebot

Todas as issues de sourcebot-dev/sourcebot

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.