Exposure of Sensitive Information to an Unauthorized Actor

  package main
  
  import (
      "log"
      "os"
  )
  
  func main() {
      apiKey := os.Getenv("API_KEY")
-     log.Printf("API Key: %s", apiKey)
+     if apiKey == "" {
+         log.Fatal("API_KEY not configured")
+     }
+     log.Println("API key configured:", len(apiKey) > 0)
+     // Use apiKey internally, never log or return it
  }
  

- client := openai.NewClient("sk-proj-1234567890abcdefghijklmnop")
- log.Printf("Using key: %s", apiKey)
- http.Handle("/models/", http.FileServer(http.Dir("./models")))
+ client := openai.NewClient(os.Getenv("OPENAI_API_KEY"))
+ log.Printf("Request completed: model=%s tokens=%d", model, usage.TotalTokens)
+ 
+ modelsHandler := http.FileServer(http.Dir("./models"))
+ http.Handle("/models/", authMiddleware(rateLimiter(modelsHandler)))
  

- resp, _ := client.CreateChatCompletion(ctx, openai.ChatCompletionRequest{
-     Messages: []openai.ChatCompletionMessage{{
-         Content: fmt.Sprintf("User SSN: %s, Password: %s", user.SSN, password),
-     }},
- })
- log.Printf("Request: %v", messages)
+ safeMessage := maskPII(userInput)
+ safeMessage = redactCredentials(safeMessage)
+ 
+ resp, _ := client.CreateChatCompletion(ctx, openai.ChatCompletionRequest{
+     Messages: []openai.ChatCompletionMessage{{Content: safeMessage}},
+ })
+ log.Printf("Completed: model=%s tokens=%d", model, resp.Usage.TotalTokens)
  

- app.get('/config', (req, res) => {
-   res.json({ apiKey: process.env.API_KEY });
- });
+ const apiKey = process.env.API_KEY;
+ // Use the key server-side only
+ const result = await externalApi.call({ key: apiKey });
+ res.json({ data: result });
  

  const openai = new OpenAI({
-   apiKey: 'sk-proj-1234567890abcdefghijklmnop'
+   apiKey: process.env.OPENAI_API_KEY
  });
  

- const response = await openai.chat.completions.create({
-   messages: [{ role: 'user', content: `Process: ${userRecord}` }]
+ const masked = maskPII(userRecord);
+ const response = await openai.chat.completions.create({
+   messages: [{ role: 'user', content: `Process: ${masked}` }]
  });
  

- from flask import jsonify
- 
- @app.route('/api/data')
- def handler():
-     try:
-         return jsonify(process())
-     except Exception as e:
-         return jsonify({'error': str(e), 'trace': traceback.format_exc()}), 500
+ import logging
+ from flask import jsonify
+ 
+ logger = logging.getLogger(__name__)
+ 
+ @app.route('/api/data')
+ def handler():
+     try:
+         return jsonify(process())
+     except Exception as e:
+         logger.error(f"Error: {e}", exc_info=True)
+         return jsonify({'error': 'Internal server error'}), 500
  

- messages = [{
-     'role': 'user',
-     'content': f"User SSN: {user.ssn}, email: {user.email}. Summarize profile."
- }]
- logging.info(f"Request: {messages}")
- response = openai.chat.completions.create(model='gpt-4', messages=messages)
+ from presidio_analyzer import AnalyzerEngine
+ from presidio_anonymizer import AnonymizerEngine
+ 
+ analyzer = AnalyzerEngine()
+ anonymizer = AnonymizerEngine()
+ 
+ def anonymize_text(text: str) -> str:
+     results = analyzer.analyze(text=text, language='en')
+     return anonymizer.anonymize(text=text, analyzer_results=results).text
+ 
+ safe_message = anonymize_text(user_message)
+ messages = [{'role': 'user', 'content': safe_message}]
+ response = openai.chat.completions.create(model='gpt-4', messages=messages)
+ logger.info('Completed', extra={'model': 'gpt-4', 'tokens': response.usage.total_tokens})
  

  from flask import jsonify
  from models import User
  
  @app.route('/api/users')
  def get_users():
      users = User.query.all()
-     return jsonify([u.__dict__ for u in users])
+     return jsonify([{
+         'id': u.id,
+         'email': u.email,
+         'name': u.name
+     } for u in users])