Follow-up from the security audit of the deployment-token ai_gateway:execute PR.
Deployment tokens (injected as TEMPS_API_TOKEN into every deployed container, minted with ["*"], never expire) can now call the AI gateway by default. The audit flagged:
- HIGH: no per-token/per-project rate limit or spending cap on
/ai/v1/chat/completions and /ai/v1/embeddings. A runaway or compromised deployed app can exhaust the operator's provider credits; all projects share the operator-scoped ai_provider_keys. Accepted as launch risk (matches the EmailsSend precedent) but needs a real limiter: per-project sliding window at the handler layer + configurable budget.
- MEDIUM (follow-up):
ai_usage_logs has no project_id/token_id columns, so deployment-token spend (now stored with user_id = NULL) can't be attributed to a project. Add the columns + populate from auth.deployment_token_info() to enable per-project cost reporting and quotas.
Follow-up from the security audit of the deployment-token
ai_gateway:executePR.Deployment tokens (injected as
TEMPS_API_TOKENinto every deployed container, minted with["*"], never expire) can now call the AI gateway by default. The audit flagged:/ai/v1/chat/completionsand/ai/v1/embeddings. A runaway or compromised deployed app can exhaust the operator's provider credits; all projects share the operator-scopedai_provider_keys. Accepted as launch risk (matches the EmailsSend precedent) but needs a real limiter: per-project sliding window at the handler layer + configurable budget.ai_usage_logshas noproject_id/token_idcolumns, so deployment-token spend (now stored withuser_id = NULL) can't be attributed to a project. Add the columns + populate fromauth.deployment_token_info()to enable per-project cost reporting and quotas.