security: prevent API key leakage in wrapper script logs (fixes #263)

[GaneshPatil7517]

@pradeeban

Summary

This PR resolves Issue #263 by preventing API keys from being printed to stdout in wrapper scripts.

Previously, the API key was printed directly:

print(apikey)

Since stdout is captured into concoreout.txt, this resulted in credentials being stored in plaintext log files.

Changes Made

• Removed print(apikey) from:

  • demo/cwrap.py
  • demo/pwrap.py
  • ratc/cwrap.py
  • ratc/pwrap.py

• Sanitized debug URL print in demo/cwrap.py and ratc/cwrap.py to use <APIKEY_HIDDEN> placeholder instead of the actual key.

• No logic changes API key is still read and used for HTTP requests, just never printed.

Security Impact

• Prevents credential leakage in log files
• Removes API key from debug URL output
• Reduces risk of accidental key exposure

Scope

• Minimal change (6 lines across 4 files)
• No logic modifications
• No concore-lite changes
• No Verilog changes

Testing

• All 4 modified files pass Python syntax validation
• Full test suite passes (57/57 tests)
• Verified no print(apikey) remains anywhere in the repository

[Copilot]

Pull request overview

This PR addresses a critical security vulnerability where API keys were being printed to stdout in wrapper scripts, resulting in credentials being stored in plaintext log files (concoreout.txt). The fix removes direct API key printing and sanitizes debug URL output to prevent credential exposure while maintaining full functionality.

Changes:

• Removed print(apikey) statements from all four wrapper scripts (demo/cwrap.py, demo/pwrap.py, ratc/cwrap.py, ratc/pwrap.py)
• Replaced removed print statements with security-focused comments
• Sanitized debug URL prints in cwrap.py files to use <APIKEY_HIDDEN> placeholder instead of actual API key

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
demo/pwrap.py	Removed API key print statement, replaced with security comment
demo/cwrap.py	Removed API key print statement and sanitized debug URL to hide API key
ratc/pwrap.py	Removed API key print statement, replaced with security comment
ratc/cwrap.py	Removed API key print statement and sanitized debug URL to hide API key

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pradeeban]

Pls remove the comments "do not log for security reasons."

Just removing the print(apikey) is sufficient. The inclusion was meant as a debug mechanism.
Actually if we really used logger properly, this could have been a logger.DEBUG.