Skip to content

fix: the docs-chat api route at docs-site/app/api/do... in route.js#12

Open
orbisai0security wants to merge 1 commit into
vercel-labs:mainfrom
orbisai0security:fix-docs-chat-api-key-credential-exposure
Open

fix: the docs-chat api route at docs-site/app/api/do... in route.js#12
orbisai0security wants to merge 1 commit into
vercel-labs:mainfrom
orbisai0security:fix-docs-chat-api-key-credential-exposure

Conversation

@orbisai0security
Copy link
Copy Markdown

Summary

Fix critical severity security issue in docs-site/app/api/docs-chat/route.js.

Vulnerability

Field Value
ID V-001
Severity CRITICAL
Scanner multi_agent_ai
Rule V-001
File docs-site/app/api/docs-chat/route.js:69

Description: The docs-chat API route at docs-site/app/api/docs-chat/route.js references an API key at lines 69 and 71 directly within the route handler. If the key is a string literal rather than a reference to a server-side environment variable (process.env), it is exposed to anyone with read access to the repository, the deployed server bundle, or any error message that echoes configuration values. This is a common and high-impact credential exposure pattern.

Changes

  • docs-site/app/api/docs-chat/route.js

Verification

  • Build passes
  • Scanner re-scan confirms fix
  • LLM code review passed

Automated security fix by OrbisAI Security

Automated security fix generated by Orbis Security AI
@vercel
Copy link
Copy Markdown

vercel Bot commented May 16, 2026

@orbisai0security is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant