New plugin for OpenAI tokens - Githubissues

Yelp / detect-secrets

An enterprise friendly way of detecting and preventing secrets in code.

Apache License 2.0

3.58k stars 449 forks source link

New plugin for OpenAI tokens #823

Closed Chandra158 closed 2 months ago

Chandra158 commented 2 months ago

Please check if the PR fulfills these requirements

[x] Tests for the changes have been added
[x] Docs have been added / updated
[x] All CI checks are green

What kind of change does this PR introduce?

Feature: New plugin to detect OpenAI api keys

Token Format

User API keys (legacy): sk-[20_alpha_numberic] T3BlbkFJ [20_alpha_numberic] (T3BlbkFJ = base64 for "OpenAI")
- there's no official documentation but found this community forum which mentions legacy token format
Project API keys: sk-<project_name>-[20_alpha_numberic] T3BlbkFJ [20_alpha_numberic]
Generated tokens for both from OpenAI portal and verified manually

Token verification

Checking whether token is active might not be possible; so haven't implemented verify() method for the plugin:

No official API to check validity of tokens (refs: openai api-reference)
Calling random apis (like: v1/models) may or may not work because of the restrictions placed on tokens during creation
- another downside could be credit usage for valid tokens

Tests

New tests added for plugin

Tested manually in local with sample token in file

  {
    "type": "OpenAI Token",
    "filename": "test_data/files/file_with_secrets.py",
    "hashed_secret": "007111295d396c8234d268fa24014ef5235136b0",
    "is_verified": false,
    "line_number": 5
  }