fix: prevent GitHub PAT leak and move Gemini API key to header in architecture endpoint#6235
Conversation
…hitecture endpoint
The POST /api/architecture endpoint embedded the server's GitHub PAT
directly into the git clone URL (x-access-token:{token}@github.com/...).
When clone failed, git's stderr output included the full URL with the
token, which was logged verbatim via console.error — leaking the PAT
to server logs accessible to anyone with log access.
Fixes:
1. Uses GIT_ASKPASS to provide credentials to git instead of embedding
them in the URL, keeping the token out of process arguments and
error output.
2. Adds sanitizeError() to strip x-access-token patterns from error
messages before logging.
3. Moves GEMINI_API_KEY from URL query parameter to x-goog-api-key
request header to prevent exposure to proxy/CDN logs.
Fixes JhaSourav07#6233
Human Coded
|
@atul-upadhyay-7 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel. A member of the Team first needs to authorize it. |
📦 Next.js Bundle Size Report (Gzipped Sizes)✨ No significant bundle size changes detected. 📊 Summary of Totals
|
Aamod-Dev
added
GSSoC 2026
mentor:Aamod007
level:critical
Aamod-Dev
left a comment
Aamod-Dev
left a comment
There was a problem hiding this comment.
Excellent security fixes! Moving the GitHub PAT out of the clone URL and into GIT_ASKPASS in app/api/architecture/route.ts is the standard way to prevent credential leakage in git stderr. The sanitizeError() helper adds a great layer of defense-in-depth for the server logs. Moving the Gemini API key to the header x-goog-api-key is also best practice. Approved!
JhaSourav07
added
the
gssoc:approved
|
🎉 Congratulations @atul-upadhyay-7! Your PR has been successfully merged. 🚀 Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.
Keep building! 💻✨ |
3 participants
Summary
Fixes two credential exposure vulnerabilities in the unauthenticated
POST /api/architectureendpoint:x-access-token:{token}@github.com/...). When clone failed, git's stderr output included the full URL with the token, logged verbatim viaconsole.error.GEMINI_API_KEYwas passed as a URL query parameter, exposing it to proxy/CDN logs and outbound request logs.Changes
1. GitHub PAT — Use GIT_ASKPASS instead of URL embedding
Instead of embedding the token in the clone URL, we now use
GIT_ASKPASSto provide credentials to git. This keeps the token out of process arguments, shell history, and error output.2. Error sanitization
Added
sanitizeError()to stripx-access-token:...@patterns from error messages before logging, as a defense-in-depth measure.3. Gemini API key — Move from URL to header
Moved the Gemini API key from the URL query parameter to the
x-goog-api-keyrequest header to prevent exposure to proxy/CDN logs.Testing
Fixes #6233
Human Coded