From edc0d585c3b146bba5cf6f33b86cad3bccda9181 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 23:08:11 +0200 Subject: [PATCH] fix: Remove clear-text storage of API key (CodeQL alert #8) - Remove api_key parameter from generate_api_config() - Update API_CONFIG_TEMPLATE to read TEST_API_KEY from environment at runtime - Pass TEST_API_KEY via Docker env vars instead of writing to config file - Fixes py/clear-text-storage-sensitive-data vulnerability - API key is now read from os.environ.get('TEST_API_KEY') at runtime --- test/finetune/test_benchmark_api.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/finetune/test_benchmark_api.py b/test/finetune/test_benchmark_api.py index 682a2ee2..752d98c1 100644 --- a/test/finetune/test_benchmark_api.py +++ b/test/finetune/test_benchmark_api.py @@ -272,6 +272,8 @@ def run_benchmark_api( # Pass API credentials for use inside Docker "OPENAI_API_KEY": api_key, "OPENAI_BASE_URL": docker_api_base_sdk, # SDK auto-appends /chat/completions + # Security: Pass TEST_API_KEY for config file to read at runtime (not stored in file) + "TEST_API_KEY": api_key, } # Add HF token for gated datasets (e.g., ChemCoTBench) if hf_token: