search

atharva434 / INCF-Impact-visualization-Portal

3 stars 8 forks source link

Exposed API Key in Visualization/retrievalqna.py #13

Closed LostSputnik closed 3 months ago

LostSputnik commented 4 months ago

Issue Description: While reviewing the project's codebase, I noticed that the Cohere API key is directly exposed within the Visualization/retrievalqna.py file. Exposing sensitive credentials publicly can pose a significant security risk, potentially allowing unauthorized access to associated services.

Suggested Fix: I recommend removing the API key from the codebase and instead utilizing environment variables or a configuration file that is not tracked by Git to manage sensitive information. This approach would help in keeping the credentials secure while still allowing the application to access necessary services.

LostSputnik commented 4 months ago

I am willing to work on resolving this issue by implementing the suggested fix, ensuring that the API key is securely managed. If assigned, I would proceed to remove the exposed API key, update the documentation as necessary to guide future users on how to set up their environment variables or configuration file, and submit a pull request for review.

Looking forward to your guidance on this matter and hoping to contribute to enhancing the project's security.

atharva434 commented 4 months ago

LostSputnik thanks for pointing it out. Will be really great if you could close the issue!

LostSputnik commented 3 months ago

Sure, I'll start working on it. Thanks!