Skip to content

Remove hardcoded API key from test file#19

Merged
mocolicious merged 2 commits intochen/test-bugsfrom
copilot/sub-pr-18
Jan 6, 2026
Merged

Remove hardcoded API key from test file#19
mocolicious merged 2 commits intochen/test-bugsfrom
copilot/sub-pr-18

Conversation

Copy link
Contributor

Copilot AI commented Jan 5, 2026

Commit cca4f18 introduced a hardcoded API key in the test setup, exposing credentials in source control.

Changes:

  • Reverted ExampleInstrumentedTest.kt line 43 from hardcoded API key back to empty string
// Before (security issue)
Altude.setApiKey(context,"ak_f8AEgOp8_hLocOBr6S4m6d8xo7T0QKHKB4s2BiamaDc")

// After (restored original)
Altude.setApiKey(context,"")

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: mocolicious <6373607+mocolicious@users.noreply.github.com>
Copilot AI changed the title [WIP] WIP address feedback from review on init fix PR Remove hardcoded API key from test file Jan 5, 2026
Copilot AI requested a review from mocolicious January 5, 2026 23:49
@mocolicious
Copy link
Contributor

@copilot is it possible to remove or obfuscate that key from Git history so its not exposed

Copy link
Contributor Author

Copilot AI commented Jan 5, 2026

@copilot is it possible to remove or obfuscate that key from Git history so its not exposed

I cannot rewrite Git history to remove the API key because:

  1. I don't have force-push permissions (required for history rewriting)
  2. The API key exists in commit d616c3b which is part of the base branch and the parent PR init fix #18

Recommended actions:

  1. Revoke the exposed API key ak_f8AEgOp8_hLocOBr6S4m6d8xo7T0QKHKB4s2BiamaDc immediately and generate a new one
  2. A repository admin can use tools like BFG Repo-Cleaner or git filter-repo to remove the key from history:
    bfg --replace-text replacements.txt
    git push --force
  3. After history is cleaned, all contributors will need to re-clone the repository

The current commit (10655fd) removes the key from the code, but once a secret is committed to Git, it should be considered compromised and rotated.

@mocolicious mocolicious marked this pull request as ready for review January 6, 2026 00:58
@mocolicious mocolicious merged commit 34885ac into chen/test-bugs Jan 6, 2026
1 check passed
@mocolicious mocolicious deleted the copilot/sub-pr-18 branch January 6, 2026 01:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants