Repository navigation
fix(describegpt): redact --api-key and --ckan-token from the attribution - #4766
Merged
Merged
Conversation
describegpt's attribution records the command line that ran, and it is copied into every generated dictionary, description and tag set -- files meant to be shared. The values of -k/--api-key and --ckan-token are now replaced with [REDACTED] in every spelling docopt accepts: `--opt value`, `--opt=value`, and stuck or clustered short options (`-kKEY`, `-Ak KEY`). qsv's docopt rejects abbreviated long options, so exact names suffice. Arguments after `--` are left alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Up to standards ✅🟢 Issues
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
describegpt's attribution includes a
Command line:entry copied fromargv, and that attribution goes into every data dictionary, description and tag set it generates. Those files are meant to be shared, so a key passed on--api-keyleaked into them. Verikan had to add its own redaction for this (dathere/Verikan#18 moves its key toQSV_LLM_APIKEY).normalize_command_linenow replaces the values of-k/--api-keyand--ckan-tokenwith[REDACTED]. It covers every spelling qsv's docopt accepts:--api-key KEYand--api-key=KEY-kKEY,-Ak KEY,-qAkKEY. I checked that qsv's docopt accepts these, e.g.slice -nl1.--api) don't need handling, because qsv's docopt rejects them ("Unknown flag").Values of other options are left verbatim, even if they contain a
k(-mkimi-k2is modelkimi-k2), and so is everything after--.Tests: a new unit test,
normalize_command_line_redacts_secret_option_values, covers each spelling and the non-secret cases. I mutation-checked it: with the secret option lists emptied, it fails.cargo t describegptpasses (258 unit and 107 integration tests), and clippy is clean.--process-response(the MCP path) leaves{GENERATED_BY_SIGNATURE}unsubstituted, so these tests can't run the attribution end to end without an LLM.provenance_command_lineis justnormalize_command_line(env::args()), which the unit test covers.The CHANGELOG entry tells users to redact or regenerate files generated by earlier versions, and to consider rotating the key.
🤖 Generated with Claude Code