Unauthenticated API key proxy: any local process can consume Anthropic credits

[consigcody94]

Found via code audit. proxy/server.go:85-99,318. Proxy reads ANTHROPIC_API_KEY from env and forwards it upstream. Listens with zero authentication. Any local process uses your credits.

[0xRaghu]

Hey @consigcody94 , thanks for raising this issue. I'm taking a look at it now. Will resolve by today.

[consigcody94]

@0xRaghu The simplest fix is adding a bearer token check on the proxy endpoints. Even a static token from an env var would close the unauthenticated access path. Check out https://github.com/consigcody94 for more of my work. A follow is appreciated.

[0xRaghu]

Agreed - and good catch. I initially started implementing a bearer token check on the proxy endpoints, but then realized mnemo doesn't actually need LLM inference functionality at all. It was leftover code I'd been using during dev for testing. Removed it entirely in #6.

Appreciate you flagging this and helping make mnemo more secure. Followed back.

[consigcody94]

@0xRaghu Removing the LLM proxy entirely is even better than adding auth to it. Less code = less attack surface. Appreciate the follow back. Check out https://github.com/consigcody94/noaa-gpu-kernels for the GPU research side of my work if that interests you.