[Security] init persists env-var API keys into config.json despite prompting "leave blank to use $ENV" #281
Description
Description
The init API-key prompt says "Enter your API key (will be stored in config), or leave blank to use $API_KEY_ENV env var". But when the user leaves the field blank and the key exists in the environment, the code writes the env value into config.json:
- The secret is duplicated into the config file (plaintext on disk) even though the user opted to keep it out of the file.
resolveApiKey()(src/llm/client.ts:16–21) gives the storedconfig.apiKeyprecedence over the env var, so later changing$API_KEY_ENVhas no effect — the config file silently wins.
Location
src/commands/init.ts lines 126–139
Code
const existingKey = existingConfig?.apiKey ?? process.env[apiKeyEnv] ?? '';
...
if (keyResult) {
apiKey = keyResult;
} else if (existingKey) {
apiKey = existingKey; // env value gets stored into config.json
} else {
apiKey = '';
}Suggested fix
Track whether the key came from the env var. If the user leaves the field blank, do not assign apiKey; rely on resolveApiKey() falling back to the env var at runtime.
Impact
Users who prefer env-var-based keys get the secret written to disk anyway, and the "env override" behavior they rely on stops working because the file value shadows the env var.
Activity
kragent66-glitch commentedon Sep 21, 2026
Hi — I'd like to pick this up. I'll review PR #289 and either verify the fix is complete or open a corrected PR.
kragent66-glitch commentedon Sep 21, 2026
Hi — I've got a fix for this; opening a PR shortly
kragent66-glitch commentedon Oct 22, 2026
This was fixed and merged — PR #311 (
fix(init): stop persisting env-var API keys into config.json, merged 2026-09-26).initno longer writes a key that came from the environment intoconfig.json; it only persists a key the user typed in explicitly, and the env-var path is left as a reference.Since the issue is still open and assigned to me, I think it can be closed. If you've since found a path #311 missed (a provider with a custom env var, or a config written before the fix and re-serialised), tell me and I'll pick it up again.