Skip to content

Ai config #358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
piyushroshan wants to merge 3 commits into
base: develop
Choose a base branch
from
Open

Ai config #358

piyushroshan wants to merge 3 commits into from

Conversation

@piyushroshan
Copy link
Collaborator

@piyushroshan piyushroshan commented Jan 19, 2026

Description

Add other AI usage

Testing

Local

Documentation

Make sure that you have documented corresponding changes in this repository.

github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 19, 2026
View reviewed changes
services/chatbot/src/chatbot/chat_api.py
logger.error("openai_api_key not provided")
return jsonify({"message": "openai_api_key not provided"}), 400
openai_api_key: str = data["openai_api_key"]
logger.debug("OpenAI API Key %s", openai_api_key[:5])

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (password)
Loading
as clear text.

Copilot Autofix

AI about 23 hours ago

In general, the fix is to avoid logging any portion of sensitive credentials, even with masking or truncation, and instead log non‑sensitive metadata (e.g., that initialization occurred, which provider, maybe a hashed or opaque identifier if truly needed). Here, the simplest and safest change is to remove the API key value from the debug message entirely and replace it with a generic message that does not include the key contents.

Concretely, in services/chatbot/src/chatbot/chat_api.py, within the init() function, change line 80 from logger.debug("OpenAI API Key %s", openai_api_key[:5]) to a message like logger.debug("Received OpenAI API key for session %s", session_id) or just logger.debug("Received OpenAI API key"). This preserves the intent of having a debug trace that the key was provided, without exposing any part of the secret. No new imports or helper methods are required; we only change the log message and its parameters. The rest of the logic (storing and using the key) remains unchanged.

Suggested changeset 1
services/chatbot/src/chatbot/chat_api.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/services/chatbot/src/chatbot/chat_api.py b/services/chatbot/src/chatbot/chat_api.py
--- a/services/chatbot/src/chatbot/chat_api.py
+++ b/services/chatbot/src/chatbot/chat_api.py
@@ -77,7 +77,7 @@
             logger.error("openai_api_key not provided")
             return jsonify({"message": "openai_api_key not provided"}), 400
         openai_api_key: str = data["openai_api_key"]
-        logger.debug("OpenAI API Key %s", openai_api_key[:5])
+        logger.debug("Received OpenAI API key for session %s", session_id)
         await store_api_key(session_id, openai_api_key, provider)
         return jsonify({"message": "Initialized"}), 200
     if provider == "anthropic":
EOF
@@ -77,7 +77,7 @@
logger.error("openai_api_key not provided")
return jsonify({"message": "openai_api_key not provided"}), 400
openai_api_key: str = data["openai_api_key"]
logger.debug("OpenAI API Key %s", openai_api_key[:5])
logger.debug("Received OpenAI API key for session %s", session_id)
await store_api_key(session_id, openai_api_key, provider)
return jsonify({"message": "Initialized"}), 200
if provider == "anthropic":
Copilot is powered by AI and may make mistakes. Always verify output.
services/chatbot/src/chatbot/chat_api.py
logger.error("anthropic_api_key not provided")
return jsonify({"message": "anthropic_api_key not provided"}), 400
anthropic_api_key: str = data["anthropic_api_key"]
logger.debug("Anthropic API Key %s", anthropic_api_key[:5])

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (password)
Loading
as clear text.

Copilot Autofix

AI about 23 hours ago

In general, to fix clear-text logging of sensitive information, remove the sensitive value from log messages, or replace it with non-sensitive metadata (e.g., a constant message like “API key provided” or a derived, non-reversible identifier). Do not log any part of API keys, passwords, tokens, or similar secrets, even at debug level.

For this specific code, the minimal fix without changing functionality is to adjust the logger.debug call on line 95 so that it doesn’t include anthropic_api_key[:5] at all. The log can still indicate that an Anthropic API key was received or that initialization is proceeding, but must not print any portion of the key. We do not need new imports, helper methods, or structural changes; just update the logging statement.

Concretely, in services/chatbot/src/chatbot/chat_api.py, change:

95:         logger.debug("Anthropic API Key %s", anthropic_api_key[:5])

to something like:

95:         logger.debug("Anthropic API Key received for session %s", session_id)

This preserves useful debugging information (which session is being initialized) while eliminating the sensitive data from the sink. No other lines require modification for this specific issue.

Suggested changeset 1
services/chatbot/src/chatbot/chat_api.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/services/chatbot/src/chatbot/chat_api.py b/services/chatbot/src/chatbot/chat_api.py
--- a/services/chatbot/src/chatbot/chat_api.py
+++ b/services/chatbot/src/chatbot/chat_api.py
@@ -92,7 +92,7 @@
             logger.error("anthropic_api_key not provided")
             return jsonify({"message": "anthropic_api_key not provided"}), 400
         anthropic_api_key: str = data["anthropic_api_key"]
-        logger.debug("Anthropic API Key %s", anthropic_api_key[:5])
+        logger.debug("Anthropic API Key received for session %s", session_id)
         await store_api_key(session_id, anthropic_api_key, provider)
         return jsonify({"message": "Initialized"}), 200
     error = _validate_provider_env(provider)
EOF
@@ -92,7 +92,7 @@
logger.error("anthropic_api_key not provided")
return jsonify({"message": "anthropic_api_key not provided"}), 400
anthropic_api_key: str = data["anthropic_api_key"]
logger.debug("Anthropic API Key %s", anthropic_api_key[:5])
logger.debug("Anthropic API Key received for session %s", session_id)
await store_api_key(session_id, anthropic_api_key, provider)
return jsonify({"message": "Initialized"}), 200
error = _validate_provider_env(provider)
Copilot is powered by AI and may make mistakes. Always verify output.
services/chatbot/src/chatbot/chat_api.py
if provider in {"openai", "anthropic"} and provider_api_key:
logger.debug(
"OpenAI API Key for session %s: %s", session_id, openai_api_key[:5]
"Provider API key for session %s: %s", session_id, provider_api_key[:5]

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (password)
Loading
as clear text.
This expression logs
sensitive data (password)
Loading
as clear text.
This expression logs
sensitive data (password)
Loading
as clear text.
This expression logs
sensitive data (password)
Loading
as clear text.
This expression logs
sensitive data (password)
Loading
as clear text.
This expression logs
sensitive data (password)
Loading
as clear text.

Copilot Autofix

AI about 23 hours ago

General approach: Do not log API keys (or any part of them) at all. Instead, log nonsensitive metadata, such as whether a key is configured/initialized and for which session or provider. Avoid emitting environment-derived secrets into logs anywhere.

Concrete fix for this codebase:

  • In chat_api.py’s state() endpoint, replace the logger.debug call that includes provider_api_key[:5] with a message that indicates only the presence of a key (e.g., True/False) and the session ID. This removes the direct flow of secret data into the logger while preserving observability about initialization.
  • No changes are needed in config.py or session_service.py for logging, because they currently only read and return secrets, not log them. CodeQL’s variants 2–5 trace the same sensitive sources but the only actual sink is the logging call in chat_api.py. Once that sink no longer contains the key, all variants will be addressed.

Details:

  • File: services/chatbot/src/chatbot/chat_api.py
    • Region around lines 145–155.
    • Change:
      • From: logger.debug("Provider API key for session %s: %s", session_id, provider_api_key[:5])
      • To: logger.debug("Provider API key configured for session %s: %s", session_id, bool(provider_api_key))
    • This keeps the debug log informative (you can still see whether a key is configured) without ever including any part of the secret value.

No new imports, methods, or definitions are required.

Suggested changeset 1
services/chatbot/src/chatbot/chat_api.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/services/chatbot/src/chatbot/chat_api.py b/services/chatbot/src/chatbot/chat_api.py
--- a/services/chatbot/src/chatbot/chat_api.py
+++ b/services/chatbot/src/chatbot/chat_api.py
@@ -150,7 +150,9 @@
     provider_api_key = await get_api_key(session_id)
     if provider in {"openai", "anthropic"} and provider_api_key:
         logger.debug(
-            "Provider API key for session %s: %s", session_id, provider_api_key[:5]
+            "Provider API key configured for session %s: %s",
+            session_id,
+            bool(provider_api_key),
         )
         chat_history = await get_chat_history(session_id)
         # Limit chat history to last 20 messages
EOF
@@ -150,7 +150,9 @@
provider_api_key = await get_api_key(session_id)
if provider in {"openai", "anthropic"} and provider_api_key:
logger.debug(
"Provider API key for session %s: %s", session_id, provider_api_key[:5]
"Provider API key configured for session %s: %s",
session_id,
bool(provider_api_key),
)
chat_history = await get_chat_history(session_id)
# Limit chat history to last 20 messages
Copilot is powered by AI and may make mistakes. Always verify output.
@github-actions
Copy link

github-actions bot commented Jan 19, 2026

Test Results

93 tests   93 ✅  2s ⏱️
17 suites   0 💤
 7 files     0 ❌

Results for commit eab5398.

@github-actions
Copy link

github-actions bot commented Jan 19, 2026

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines Covered Coverage Threshold Status
1363 1090 80% 0% 🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: eab5398 by action🐍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@piyushroshan