[security] Remove API key regex patterns from client-side JS (#793) #836

Closed

sleepy wants to merge 0 commits from fix/client-side-api-key-regex-793 into main

sleepy commented

2026-06-03 20:20:00 +02:00

Owner

Fixes #793. API key prefix regex patterns were exposed in client-side slashCommands.js. Moved PROVIDER_PATTERNS matching to server-side POST /api/detect-key-provider endpoint.

sleepy added 1 commit

2026-06-03 20:20:01 +02:00

[security] Remove API key regex patterns from client-side JS (#793 ) 894f378b74

Move API key prefix matching (sk-ant-, sk-or-, sk-proj-, gsk_, AIza,
xai-) from client-side PROVIDER_PATTERNS in slashCommands.js to a new
server-side POST /api/detect-key-provider endpoint in model_routes.py.

Key prefix patterns exposed in client-side JS reveal the expected format
of API keys for each supported provider. This information could aid an
attacker in crafting or enumerating valid keys.

The detectProvider() function is now async and delegates non-URL inputs
to the server endpoint. URL detection remains client-side (not
sensitive). Both callers (handleSetupInput, handleSetupWizard) were
already async and now await the result.

The censor.js key patterns are intentionally left unchanged — they serve
a defensive purpose (blurring leaked keys in chat output) rather than
key validation.

Fixes #793.

sleepy referenced this pull request

2026-06-03 20:20:08 +02:00

[frontend/security] API key prefixes regex-matched in client-side slashCommands.js #793

sleepy closed this pull request

2026-06-04 11:42:17 +02:00