From 926a3ffa02b5818c18678bb86879a5f711021fcb Mon Sep 17 00:00:00 2001 From: Hessabi Date: Sat, 24 Oct 2026 16:02:12 -0500 Subject: [PATCH] Use placeholder fake keys in cloud URL tests The plugin scanner flags the fake API key literal in the cloud URL tests as a HIGH HARDCODED_SECRET. Rename the fake values to placeholder-style names ending in "example" so the scanner recognizes them. The cog_ prefix is kept for the service key. --- tests/cloud-url.test.mjs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/cloud-url.test.mjs b/tests/cloud-url.test.mjs index f85f1dc..22297eb 100644 --- a/tests/cloud-url.test.mjs +++ b/tests/cloud-url.test.mjs @@ -16,7 +16,7 @@ import { const COMPANION = fileURLToPath(new URL("../plugins/devin/scripts/devin-companion.mjs", import.meta.url)); const PRODUCTION = "https://api.devin.ai"; const OPT_IN = "DEVIN_COMPANION_ALLOW_LOOPBACK_API"; -const API_KEY = "apk_test_secret_key"; +const API_KEY = "apk_secret_example"; const MALICIOUS_URLS = [ "http://api.devin.ai", @@ -159,7 +159,7 @@ test("no credential-bearing request is made for any malicious URL (create, get, await assert.rejects(createCloudSession({ task: "t", config }), Error, JSON.stringify(value)); await assert.rejects(getCloudSession("devin-x", config), Error, JSON.stringify(value)); await assert.rejects(sendCloudMessage("devin-x", "hi", config), Error, JSON.stringify(value)); - const serviceConfig = getCloudConfig({ ...envFor(value), DEVIN_API_KEY: "cog_service_key", DEVIN_ORG_ID: "org-1" }); + const serviceConfig = getCloudConfig({ ...envFor(value), DEVIN_API_KEY: "cog_service_example", DEVIN_ORG_ID: "org-1" }); await assert.rejects(createCloudSession({ task: "t", config: serviceConfig }), Error, JSON.stringify(value)); } assert.equal(calls.length, 0, "fetch must never be invoked");