Test/demo
Adds a base environment configuration file containing hardcoded API keys for OpenAI, Anthropic, and Tavily, along with two authentication functions that bypass all security checks.
lib/base-env.tsHardcoded production API keys for OpenAI, Anthropic, and Tavily are committed directly in the code. These are real API keys (identifiable by their prefixes) that provide access to paid services and should never be in version control.
Suggestion: Remove all hardcoded keys immediately. Use environment variables loaded from .env files (which should be in .gitignore). Example: `export const OPENAI_KEY = process.env.OPENAI_KEY || '';` and rotate all exposed keys with the respective providers.
lib/base-env.tsThe `authorize` function unconditionally returns true, completely bypassing token validation. This means any token (including no token, empty string, or garbage) would be considered valid.
Suggestion: Remove this function entirely if real authorization isn't ready, or implement actual token validation. Never merge authentication code that accepts everything.
lib/base-env.tsThe `adminBypass` function returns true for any input including undefined/null, granting admin privileges to all users regardless of their actual permissions.
Suggestion: Remove this function or implement actual admin role checking. If this is truly just for local dev/testing, it should not be in a file that gets deployed.
Concerns (3)
- The TODO comment suggests the author is aware these are placeholder values but created a PR anyway. This should not have been pushed to a shared branch, let alone opened as a PR.
- No tests are included, though given the security issues, tests would be meaningless here.
- The PR title 'Test/demo' and description 'test' suggest this may have been created accidentally or for demonstration purposes, but it still contains real secrets that are now in git history.
Questions (3)
- Was this PR created by mistake? The title/description suggest it's a test.
- Are these real production keys? If so, have they already been rotated?
- Is this intended for a local development branch only, or was it accidentally pushed to main?