cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [Security] Hardcoded string that looks like a real API key in a test file #4154

New issue

Open

opened 2026-04-06 11:50:07 +00:00 by freemo · 3 comments

freemo commented

2026-04-06 11:50:07 +00:00

Owner

Metadata

Branch: bugfix/hardcoded-api-key-test-file
Commit Message: fix(tests): replace hardcoded API key lookalike with clearly fake test value
Milestone: None (Backlog)
Parent Epic: TBD — requires manual linking

Background

A string that looks like a real OpenAI API key is hardcoded in a test step file. While this is likely a fake key used for testing purposes, it is a bad practice to have strings that resemble real secrets in the codebase. This can cause confusion and trigger false positives in security scanners.

Bug Report: [Security] — Hardcoded string that looks like a real API key in a test file

Severity Assessment

Impact: Low. This is in a test file, so it's unlikely to be a production secret. However, it's a bad practice to have strings that look like real secrets in the codebase.
Likelihood: Low. This is a test file and the key is likely a fake one.
Priority: Low

Location

File: features/steps/settings_coverage_boost_steps.py
Function/Class: step_given_openai_api_key_set
Lines: 114

Description

A string that looks like a real OpenAI API key is hardcoded in a test file. While this is likely a fake key for testing purposes, it's a bad practice to have strings that look like real secrets in the codebase. It can cause confusion and trigger false positives in security scanners.

Evidence

@given('the OPENAI_API_KEY environment variable is set')
def step_given_openai_api_key_set(context: Any) -> None:
    """Set OPENAI_API_KEY for testing."""
    os.environ["OPENAI_API_KEY"] = "sk-test-secret-12345"

    def cleanup() -> None:
        os.environ.pop("OPENAI_API_KEY", None)

    _add_cleanup(context, cleanup)

Expected Behavior

Test keys should be clearly identifiable as fake keys. For example, by using a value that is unambiguously not a real key, such as sk-test-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx or a similarly obvious placeholder.

Actual Behavior

A string (sk-test-secret-12345) that resembles a real API key pattern is used as a test value, which may trigger security scanners and cause confusion.

Suggested Fix

Replace the hardcoded string with a value that is clearly a fake key. For example:

os.environ["OPENAI_API_KEY"] = "sk-test-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Subtasks

Replace "sk-test-secret-12345" in features/steps/settings_coverage_boost_steps.py line 114 with a clearly fake placeholder value (e.g. "sk-test-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx")
Audit the rest of the features/steps/ directory for any other hardcoded strings that resemble real secrets
Verify all nox stages pass after the change

Definition of Done

The hardcoded API key lookalike string is replaced with an unambiguously fake placeholder
No other similar strings exist in the test files (or they are also replaced)
All nox stages pass
Coverage >= 97%

Backlog note: This issue was discovered during autonomous operation
on milestone . It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: ca-new-issue-creator

## Metadata - **Branch**: `bugfix/hardcoded-api-key-test-file` - **Commit Message**: `fix(tests): replace hardcoded API key lookalike with clearly fake test value` - **Milestone**: None (Backlog) - **Parent Epic**: TBD — requires manual linking ## Background A string that looks like a real OpenAI API key is hardcoded in a test step file. While this is likely a fake key used for testing purposes, it is a bad practice to have strings that resemble real secrets in the codebase. This can cause confusion and trigger false positives in security scanners. ## Bug Report: [Security] — Hardcoded string that looks like a real API key in a test file ### Severity Assessment - **Impact**: Low. This is in a test file, so it's unlikely to be a production secret. However, it's a bad practice to have strings that look like real secrets in the codebase. - **Likelihood**: Low. This is a test file and the key is likely a fake one. - **Priority**: Low ### Location - **File**: `features/steps/settings_coverage_boost_steps.py` - **Function/Class**: `step_given_openai_api_key_set` - **Lines**: 114 ### Description A string that looks like a real OpenAI API key is hardcoded in a test file. While this is likely a fake key for testing purposes, it's a bad practice to have strings that look like real secrets in the codebase. It can cause confusion and trigger false positives in security scanners. ### Evidence ```python @given('the OPENAI_API_KEY environment variable is set') def step_given_openai_api_key_set(context: Any) -> None: """Set OPENAI_API_KEY for testing.""" os.environ["OPENAI_API_KEY"] = "sk-test-secret-12345" def cleanup() -> None: os.environ.pop("OPENAI_API_KEY", None) _add_cleanup(context, cleanup) ``` ### Expected Behavior Test keys should be clearly identifiable as fake keys. For example, by using a value that is unambiguously not a real key, such as `sk-test-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` or a similarly obvious placeholder. ### Actual Behavior A string (`sk-test-secret-12345`) that resembles a real API key pattern is used as a test value, which may trigger security scanners and cause confusion. ### Suggested Fix Replace the hardcoded string with a value that is clearly a fake key. For example: ```python os.environ["OPENAI_API_KEY"] = "sk-test-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" ``` ### Category security ## Subtasks - [ ] Replace `"sk-test-secret-12345"` in `features/steps/settings_coverage_boost_steps.py` line 114 with a clearly fake placeholder value (e.g. `"sk-test-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"`) - [ ] Audit the rest of the `features/steps/` directory for any other hardcoded strings that resemble real secrets - [ ] Verify all nox stages pass after the change ## Definition of Done - [ ] The hardcoded API key lookalike string is replaced with an unambiguously fake placeholder - [ ] No other similar strings exist in the test files (or they are also replaced) - [ ] All nox stages pass - [ ] Coverage >= 97% > **Backlog note:** This issue was discovered during autonomous operation > on milestone <current active>. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: ca-new-issue-creator

freemo commented

2026-04-06 11:50:25 +00:00

Author

Owner

⚠️ Orphan Issue — Manual Linking Required

No parent Epic was provided when this issue was created. Per CONTRIBUTING.md, every issue must be linked to a parent Epic using Forgejo's dependency system (child blocks parent).

A project maintainer should:

Identify the appropriate parent Epic for this security/test-hygiene work
Create the dependency link so that this issue blocks the parent Epic

Until this is done, this issue is considered an orphan and may not be picked up for work.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: ca-new-issue-creator

⚠️ **Orphan Issue — Manual Linking Required** No parent Epic was provided when this issue was created. Per CONTRIBUTING.md, every issue must be linked to a parent Epic using Forgejo's dependency system (child **blocks** parent). A project maintainer should: 1. Identify the appropriate parent Epic for this security/test-hygiene work 2. Create the dependency link so that this issue **blocks** the parent Epic Until this is done, this issue is considered an orphan and may not be picked up for work. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: ca-new-issue-creator

freemo added the

Points

label

2026-04-06 11:51:31 +00:00

freemo referenced this issue

2026-04-06 11:51:49 +00:00

[Automated] CleverAgents Build Session - 2026-04-06 #3775

freemo referenced this issue

2026-04-06 11:52:12 +00:00

[Automated] CleverAgents Build Session - 2026-04-06 #3775

freemo added this to the v3.3.0 milestone

2026-04-06 17:48:48 +00:00

freemo commented

2026-04-06 18:50:04 +00:00

Author

Owner

Milestone Triage Decision: Moved to Backlog

This security logging issue has been moved out of v3.3.0 during aggressive milestone triage. While important for security, it does not relate to the core focus of Corrections + Subplans + Checkpoints.

Reasoning:

v3.3.0 focus: Essential corrections, subplan management, and checkpoint functionality
This issue: Security logging enhancement - important but not milestone-blocking
Impact: Security observability improvement, not core corrections/subplans/checkpoints functionality

Will be addressed in a future milestone focused on security hardening and observability.

**Milestone Triage Decision: Moved to Backlog** This security logging issue has been moved out of v3.3.0 during aggressive milestone triage. While important for security, it does not relate to the core focus of Corrections + Subplans + Checkpoints. **Reasoning:** - v3.3.0 focus: Essential corrections, subplan management, and checkpoint functionality - This issue: Security logging enhancement - important but not milestone-blocking - Impact: Security observability improvement, not core corrections/subplans/checkpoints functionality Will be addressed in a future milestone focused on security hardening and observability.

freemo removed this from the v3.3.0 milestone

2026-04-06 20:40:03 +00:00

HAL9000 added the

labels

2026-04-09 01:49:56 +00:00

HAL9000 added this to the v3.5.0 milestone

2026-04-09 03:12:34 +00:00

HAL9000 referenced this issue

2026-04-12 07:16:43 +00:00

[AUTO-IMP-SUP] Implementation Pool Status (Cycle 1) #7906

brent.edwards commented

2026-04-23 22:31:17 +00:00

Member

(human writing)

No human would mistake sk-test-secret-12345 for a real key:

The key contains the word "test".
The word "secret" is a common replacement for secret information.
The number "12345" is a common joke number for a "secret" number. (c.f. Spaceballs)
The key is far too short.

I would remove this bug.

(human writing) No human would mistake `sk-test-secret-12345` for a real key: - The key contains the word "test". - The word "secret" is a common replacement for secret information. - The number "12345" is a common joke number for a "secret" number. (c.f. _Spaceballs_) - The key is far too short. I would remove this bug.