[Security] API key exposure via VITE_ environment variables

[d-oit]

Description

API keys for LLM providers are read from import.meta.env.VITE_OPENROUTER_API_KEY and stored in localStorage. Vite environment variables prefixed with VITE_ are exposed to the client by default. If the app is deployed, these keys would be visible in the JavaScript bundle.

Affected Code

File: src/lib/llm/config.ts (line ~17)

const key = import.meta.env.VITE_OPENROUTER_API_KEY || localStorage.getItem("openrouter_api_key");

File: .env.example

VITE_LLM_API_KEY=
VITE_LLM_API_BASE_URL=

Impact

• API keys embedded in the client bundle are accessible to anyone inspecting the source
• Keys stored in localStorage are accessible via XSS or DevTools

Recommended Fix

1. For local-first: Accept that API keys are user-provided (not developer secrets) and document this clearly
2. Add API key masking in the UI (show only last 4 chars)
3. Add a warning in the AI Harness UI when no key is configured
4. Document that VITE_ prefixed vars are client-visible
5. Consider a proxy pattern for deployment scenarios (if ever needed)

Acceptance Criteria

• API key input field masks the key (shows ****4abc)
• Warning displayed when no API key is configured
• .env.example documents that VITE_ vars are client-visible
• README or docs explain the local-first security model for API keys