mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-14 02:42:24 +03:00
528fba953d
CodeQL alert #866 (js/clear-text-logging) flagged the console.log wrapper in nvidia-startswith-diag.ts, attributing the source to an unrelated NOAUTH_IDS constant in tests/unit/executor-web-cookie-sweep.test.ts — no real import/dataflow connects the two files. The genuine risk in this script is independent of that attribution: an upstream error or a validateProviderApiKey() result could echo the raw NVIDIA_API_KEY back through err.stack/err.message/result, which the script logs verbatim. The line() sink now strips any literal occurrence of the key before it reaches the terminal, closing the clear-text-logging class regardless of the exact taint path CodeQL reported.