fix(solution): Stop committing the ContextStream API key - #41
Conversation
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
🤖 CodeAnt AI — Review Status
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideReplace a hard-coded ContextStream API key in the Cursor MCP config with an environment-based reference so the live credential is no longer committed to the repository. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Bito Automatic Review Skipped - Branch Excluded |
codeant-ai
Bot
added
the
size:XS
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe ContextStream MCP configuration now reads ChangesContextStream credential handling
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This localized configuration change removes the committed credential from active configuration while preserving the existing integration contract; no actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Linked Issues checkExplanation The PR fulfills the coding objective in [ Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Full details: Description checkExplanation The description clearly explains the change, issue number, security impact, configuration usage, and required key rotation. It does not reproduce the repository checklist section or provide a direct issue link, but it is otherwise complete and relevant. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR addresses a critical security issue by removing a hardcoded API key from .cursor/mcp.json. The Codacy analysis indicates the changes are 'Up to Standards', with no new quality issues detected.
However, the credentials must be considered compromised because they were previously committed to the repository. Furthermore, there is no automated verification included in the PR to ensure the ${env:VAR} syntax is supported by the tool consuming this configuration. Functionality should be verified before merging to avoid breaking the MCP integration.
About this PR
- Sensitive credentials remain in the Git commit history. Removing them from the current version of the file does not prevent them from being accessed via historical commits. Manual rotation and revocation of the ContextStream API key in the provider's dashboard are required.
Test suggestions
- Verify that the Cursor/MCP client correctly interpolates the environment variable
${env:CONTEXTSTREAM_API_KEY}. - Verify that
.cursor/mcp.jsonis syntactically valid JSON after the change.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the Cursor/MCP client correctly interpolates the environment variable `${env:CONTEXTSTREAM_API_KEY}`.
2. Verify that `.cursor/mcp.json` is syntactically valid JSON after the change.
Low confidence findings
- There is no verification provided that the
${env:VAR}syntax is supported by the target MCP tool. If the tool expects a literal string and does not perform interpolation, the integration will fail.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
.cursor/mcp.json carried a live 48-character credential as a literal under the X-ContextStream-API-Key header. It was committed in a8fdb29 and pushed to this public repository, so it has been readable by anyone since. It is not on main. The literal is replaced with an environment-variable reference, so the value stops travelling with the repository and never reaches main: "X-ContextStream-API-Key": "${env:CONTEXTSTREAM_API_KEY}" Anyone using this configuration now sets CONTEXTSTREAM_API_KEY in their environment instead. The file still parses as JSON and nothing else in it changed. This does not undo the exposure. The value remains in the branch's commit history, so rotating the key in ContextStream is the only action that actually revokes access, and it is still outstanding. Secret scanning is disabled on this repository, which is why nothing caught this at push time. Found by GitHub Copilot's pull request reviewer on #11. Refs: #40
61f7671 to
43e636e
Compare
codeant-ai
Bot
added
size:XS
There was a problem hiding this comment.
Pull request overview
Replaces the committed ContextStream credential with an environment-variable reference, preventing further exposure.
Changes:
- Reads the API key from
CONTEXTSTREAM_API_KEY. - Preserves the existing MCP configuration.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
Bito Automatic Review Skipped - Files Excluded |
User description
Summary
.cursor/mcp.jsoncarried a live 48-character credential as a literal under theX-ContextStream-API-Keyheader. Committed ina8fdb29and pushed to this public repository, so it has been readable by anyone since. It is now onmain: merging #11 carried it to the default branch of this public repository as ofd73d3d9. This removes it from the branch going forward; it does not remove it frommain's history, and merging this PR does not either.Found by GitHub Copilot's PR reviewer on #11.
Closes #40.
Change
Nothing else in the file changed; it still parses as JSON. Anyone using this configuration now sets
CONTEXTSTREAM_API_KEYin their environment.Status changed since this PR was opened
When this was written the credential was confined to the #11 branch. #11 has since been merged, so the
literal is now in
.cursor/mcp.jsononmain— the default branch of a public repository — and in thehistory of every clone, fork and mirror taken since. That moves rotation from "outstanding" to the only
control that actually revokes anything; removing the value cannot.
What this does not do
It does not undo the exposure. The value is still in the branch's commit history and has been public for as long as the branch has been pushed.
Rotating the key in ContextStream is the only action that actually revokes access, and it is still outstanding. This PR stops the value travelling any further; it does not make the old one safe.
Why nothing caught it earlier
Secret scanning is disabled on this repository, so GitHub's push protection — the control that would have blocked this at push time rather than surfacing it at review — never ran. Worth enabling org-wide.
Note that #39 excluded
.cursor/**from Codacy. Trivy does secret detection and is enabled here, so that exclusion now also removes this directory from Trivy's reach. Narrowing the exclusion to markdown only, or carving.cursor/back in for Trivy specifically, is worth doing — tracked on #40.Related
37ae9bc(2024-10-16), is also still awaiting rotation.Summary by Sourcery
Bug Fixes:
CodeAnt-AI Description
Stop exposing the ContextStream API key in the repository
What Changed
CONTEXTSTREAM_API_KEYenvironment variable instead of storing the credential directlyImpact
✅ Prevents new credential exposure✅ Keeps API keys out of committed configuration✅ Preserves ContextStream configuration behavior💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit