Skip to content

Security/fix exposed secrets #113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
grrowl merged 3 commits into from
Aug 18, 2025
Merged

Security/fix exposed secrets #113

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7a6ee0b
Security: Remove exposed credentials and sensitive logging
paperboygold Aug 17, 2025
9a32456
Security: Remove exposed secrets from old frontend
paperboygold Aug 17, 2025
d84d97a
Update .dev.vars.example
grrowl Aug 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .dev.vars.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
PUBLIC_HUMANITIX_API_KEY=d139cf0cf10b5aa8eef87c8ed4f53b5921e92d165602998b9fd2409bf4ca72d177a5a235ac2485dea5b00d5e5a723d33e1e5b4c36cc6520269570d213df3ecf0d96bf893675f7b3d8eea82f881b1a72bc80048f77974d1734599b48384ad6dad7c0495904cb0a3f5f1d290c1561528
NOTION_API_KEY=
PUBLIC_HUMANITIX_API_KEY=your-humanitix-api-key-here
NOTION_API_KEY=your-notion-api-key-here
LUMA_AUTH_COOKIE=your-luma-auth-cookie-here
11 changes: 8 additions & 3 deletions app/routes/api.luma-events.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,22 @@ interface LumaEvent {
calendar_api_id?: string;
}

export async function loader({ request }: LoaderFunctionArgs) {
export async function loader({ request, context }: LoaderFunctionArgs) {
try {
const lumaAuthCookie = context.cloudflare.env.LUMA_AUTH_COOKIE;

if (!lumaAuthCookie) {
throw new Error("LUMA_AUTH_COOKIE environment variable is not set");
}

const response = await fetch(
"https://api.lu.ma/search/get-results?query=",
{
headers: {
Accept: "*/*",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "en-AU",
Cookie:
"__stripe_mid=3e440fd9-5848-4255-a736-d13cb8110069d17965; luma.auth-session-key=usr-yJC7HmpW1yGZoDL.gz273wf7elzth3nfqtt2; luma.evt-e8FFFuNlCiukxLG.referred_by=o2RUTY; luma.evt-qmoh92gxrHhCYTd.referred_by=9MULGS; luma.did=ztpj78vl60480r6blfp8x8qfyfduam; luma.first-page=%2Fapify; _ga=GA1.1.1859547030.1754129239; _ga_62P18XN9NS=GS2.1.s1754129238$o1$g0$t1754129241$j57$l0$h1816125937; luma.native-referrer=https%3A%2F%2Flu.ma%2Fcalendar%2Fmanage%2Fcal-KPakbH2wTxQuyCj%3Fperiod%3Dpast%26e%3Dcalev-f2JoHiVCLiOhYao; __cf_bm=HYlzDGL7cE3AteqvI.34jcoC8XH_0jJ2bzxpSTzpfBs-1754174489-1.0.1.1-HCazM9MmOjAPlF371bUhxI66yGu16qAkZdtKmC_51HXTUJ4U3xyg1hsROUhzn00w3343ojW6q1DBBpRpWEFtUECvy5X9ZX6LDXh0sPMl4yY",
Cookie: lumaAuthCookie,
Origin: "https://lu.ma",
Referer: "https://lu.ma/",
"Sec-Ch-Ua":
Expand Down
12 changes: 1 addition & 11 deletions app/routes/api.notion-events.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,14 +86,8 @@ export async function loader({ context }: LoaderFunctionArgs) {
try {
const notionApiKey = context.cloudflare.env.NOTION_API_KEY;

// Debug logging
console.log("Available env keys:", Object.keys(context.cloudflare.env));
console.log("Full env object:", JSON.stringify(context.cloudflare.env, null, 2));
console.log("NOTION_API_KEY exists:", !!notionApiKey);
console.log("NOTION_API_KEY length:", notionApiKey?.length || 0);
console.log("NOTION_API_KEY first 10 chars:", notionApiKey?.substring(0, 10) || 'undefined');
if (!notionApiKey) {
console.log("API key not found");
console.log("NOTION_API_KEY environment variable is not set");
return Response.json({
events: [],
message: "NOTION_API_KEY environment variable is not set",
Expand Down Expand Up @@ -216,10 +210,6 @@ export async function action({ request, context }: ActionFunctionArgs) {
try {
const notionApiKey = context.cloudflare.env.NOTION_API_KEY;

// Debug logging
console.log("POST - Available env keys:", Object.keys(context.cloudflare.env));
console.log("POST - NOTION_API_KEY exists:", !!notionApiKey);
console.log("POST - NOTION_API_KEY length:", notionApiKey?.length || 0);
if (!notionApiKey) {
return new Response(
JSON.stringify({ error: "NOTION_API_KEY environment variable is not set" }),
Expand Down
4 changes: 1 addition & 3 deletions app/routes/events.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,8 @@ interface LoaderData {
export async function loader({ context }: Route.LoaderArgs) {
const apiKey = context.cloudflare.env.PUBLIC_HUMANITIX_API_KEY;

console.log("API key:", apiKey);

if (!apiKey) {
console.error("API key not found");
console.error("PUBLIC_HUMANITIX_API_KEY environment variable is not set");
throw new Response("API key not found", { status: 500 });
}

Expand Down
2 changes: 0 additions & 2 deletions mlai-frontend/.env
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions worker-configuration.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ declare namespace Cloudflare {
VALUE_FROM_CLOUDFLARE: "Hello from Cloudflare";
PUBLIC_HUMANITIX_API_KEY: string;
NOTION_API_KEY: string;
LUMA_AUTH_COOKIE: string;
}
}
interface Env extends Cloudflare.Env {}
Expand Down