fix: remove hardcoded secret in useAiAgent.ts (CWE-798)

[anupamme]

The useAiAgent.ts file contains hardcoded API credentials embedded directly in the client-side JavaScript bundle. The AI_CONFIG object contains a hardcoded API key '[REDACTED]' which will be exposed to anyone who inspects the bundled application code through browser DevTools or by downloading and analyzing the JavaScript bundle. The affected code is packages/app/src/Hooks/useAiAgent.ts:45. This change is the fix I would apply.

Reference: CWE-798

What changed

• packages/app/src/Hooks/useAiAgent.ts

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

Regression test

The security boundary is maintained under adversarial input

Test

import * as fs from "fs";
import * as path from "path";

describe("AI configuration must not expose hardcoded API credentials in source code", () => {
  const sourceFilePath = path.resolve(__dirname, "../../packages/app/src/Hooks/useAiAgent.ts");

  const sensitivePatterns = [
    { name: "hardcoded API key literal", pattern: /apiKey\s*:\s*["']sk_[a-zA-Z0-9]+["']/ },
    { name: "hardcoded secret value", pattern: /[REDACTED]/ },
    { name: "any hardcoded secret pattern", pattern: /apiKey\s*:\s*["'][^"']+["']/ },
  ];

  test.each(sensitivePatterns)("must not contain $name in source file", ({ pattern }) => {
    const sourceContent = fs.readFileSync(sourceFilePath, "utf-8");
    expect(pattern.test(sourceContent)).toBe(false);
  });

  test("API key must reference environment variable or secure runtime source", () => {
    const sourceContent = fs.readFileSync(sourceFilePath, "utf-8");
    const hasSecurePattern = /apiKey\s*:\s*(process\.env\.|import\.meta\.env\.)/.test(sourceContent);
    expect(hasSecurePattern).toBe(true);
  });
});

---

Automated security fix by OrbisAI Security

[v0l]

Intentional