diff --git a/.gitignore b/.gitignore
index 6122aa97..be9bfdf9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -81,3 +81,8 @@ QWEN.md
 
 # Internal documentation (not for public)
 TODO.md
+
+# Test credentials
+.env.test
+*.test.env
+test_credentials.py
diff --git a/test/finetune/test_benchmark_api.py b/test/finetune/test_benchmark_api.py
index b5c7c7c9..4202ba3b 100644
--- a/test/finetune/test_benchmark_api.py
+++ b/test/finetune/test_benchmark_api.py
@@ -332,10 +332,11 @@ if __name__ == "__main__":
     os.chdir(_project_root)
 
     # ==================== API Configuration ====================
-    API_KEY = "sk-1234"
-    API_BASE = "http://localhost:3000"
-    MODEL = "gpt-4o-mini"
-    HF_TOKEN = "hf_xxxx"  # For gated datasets
+    # Use environment variables for sensitive data (fixes GitHub Security Alert #8)
+    API_KEY = os.getenv("TEST_API_KEY", "sk-1234")
+    API_BASE = os.getenv("TEST_API_BASE", "http://localhost:3000")
+    MODEL = os.getenv("TEST_MODEL", "gpt-4o-mini")
+    HF_TOKEN = os.getenv("TEST_HF_TOKEN", "hf_xxxx")  # For gated datasets
 
     # ==================== Test Configuration ====================
     MAX_OUT_LEN = 8192