Description
src/config.py sets:
SERVICE_API_KEY: str = "default_service_secret_change_me"
ADMIN_API_KEY: str = "default_admin_secret_change_me"
These are public defaults committed to the repository. Any deployment that forgets to override them in .env silently accepts these well-known strings as valid credentials — a complete authentication bypass.
Requirements & context
- Remove the default values for both fields — make them required (
Field(...)) or validate at startup that they are not equal to the known bad defaults
- Add a
@field_validator that rejects both keys if they match the old default strings or are shorter than 32 characters
- Update
.env.example with commented-out placeholder values and a security note
- Confirm the app raises a clear
ValidationError at startup if either key is missing or is the default string
Suggested execution
git checkout -b fix/insecure-default-api-keys
- Update
src/config.py
- Update
.env.example
- Add startup test asserting
ValidationError when keys are the defaults
Guidelines
- Never log the key values — only confirm presence and minimum length
- PR must include:
Closes #[issue_id]
- Timeframe: 24 hours
Description
src/config.pysets:These are public defaults committed to the repository. Any deployment that forgets to override them in
.envsilently accepts these well-known strings as valid credentials — a complete authentication bypass.Requirements & context
Field(...)) or validate at startup that they are not equal to the known bad defaults@field_validatorthat rejects both keys if they match the old default strings or are shorter than 32 characters.env.examplewith commented-out placeholder values and a security noteValidationErrorat startup if either key is missing or is the default stringSuggested execution
src/config.py.env.exampleValidationErrorwhen keys are the defaultsGuidelines
Closes #[issue_id]