gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 23:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Remove clear-text storage of API key (CodeQL alert #8)

Browse Source 
- Remove api_key parameter from generate_api_config()
- Update API_CONFIG_TEMPLATE to read TEST_API_KEY from environment at runtime
- Pass TEST_API_KEY via Docker env vars instead of writing to config file
- Fixes py/clear-text-storage-sensitive-data vulnerability
- API key is now read from os.environ.get('TEST_API_KEY') at runtime
This commit is contained in:
TPTBusiness
2026-04-02 23:08:11 +02:00
parent 2eced3ca69
commit edc0d585c3
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/finetune/test_benchmark_api.py
+2
View File
@@ -272,6 +272,8 @@ def run_benchmark_api(
# Pass API credentials for use inside Docker # Pass API credentials for use inside Docker
"OPENAI_API_KEY": api_key, "OPENAI_API_KEY": api_key,
"OPENAI_BASE_URL": docker_api_base_sdk, # SDK auto-appends /chat/completions "OPENAI_BASE_URL": docker_api_base_sdk, # SDK auto-appends /chat/completions
# Security: Pass TEST_API_KEY for config file to read at runtime (not stored in file)
"TEST_API_KEY": api_key,
} }
# Add HF token for gated datasets (e.g., ChemCoTBench) # Add HF token for gated datasets (e.g., ChemCoTBench)
if hf_token: if hf_token: