Updated README.md
Adds a troubleshooting section to README.md, but also introduces a new file containing hardcoded production API keys and broken authentication logic that bypasses all security checks.
lib/test-var.tsHardcoded production API keys are committed directly into source code. Lines 3, 5, and 7 contain real API keys for OpenAI, Anthropic, and Tavily that will be exposed in the public repository and version history. These keys have identifiable prefixes (sk-proj-, sk-ant-api03-, tvly-) indicating they are valid credentials.
Suggestion: Delete lib/test-var.ts entirely. Never commit API keys to version control. Use environment variables exclusively. If these keys are real, rotate them immediately through the respective provider dashboards before merging anything.
lib/test-var.tsThe authorize() function on line 11 returns true unconditionally for any input, completely bypassing authentication. This means any token, including empty strings or invalid values, would be accepted.
Suggestion: Remove this function entirely or implement proper token validation. If this is truly test code, it should not be in the main codebase at all.
lib/test-var.tsThe adminBypass() function on lines 19-23 returns true regardless of input (both branches return true), granting admin privileges to everyone. This completely defeats any admin access control.
Suggestion: Remove this function entirely. If admin bypass logic is needed for testing, it should be behind a feature flag and never enabled in production.
Concerns (3)
- The TODO comment 'move to env vars before merging' suggests the author knows this is wrong but committed it anyway. This file should never have been created.
- The file lib/test-var.ts appears unrelated to the stated PR purpose (adding a troubleshooting guide). This looks like accidentally committed test/debug code.
- If this PR is merged, the API keys in the commit history will remain accessible forever, even if the file is later deleted. Repository history would need to be rewritten.
Questions (3)
- Why was lib/test-var.ts included in this PR? It's completely unrelated to adding a troubleshooting section to the README.
- Are the API keys in test-var.ts real production keys? If yes, have they been rotated?
- Is there any code in the application that imports from lib/test-var.ts? If so, this creates an active security vulnerability.
Praise (1)
- The README troubleshooting section is well-written, clear, and helpful for users encountering environment variable setup issues.