Conversation
![postil-dev[bot]](https://avatars.githubusercontent.com/in/3455612?s=60&v=4){kind=small}
| }; | ||
| self.api_base = creds.api_base; | ||
| self.cascade.clear(); | ||
| self.stored_login_authority = true; |
There was a problem hiding this comment.
error · confidence 0.90 · kind: risk
This unconditionally marks the configuration as governed by the stored login after loading credentials. When an explicit provider API key is also set, later resolution can still select that key, but stored_login_authority will suppress local model and reasoning settings and cause the LLM client to omit endpoint authentication. Preserve hosted authority only when stored-login fallback is the effective credential, or clear it when an explicit API key wins.
There was a problem hiding this comment.
apply_stored_login_credential returns before credential loading when an explicit provider key exists, and Config::load assigns that result directly to stored_login_authority. The focused BYOK test preserves local model and reasoning settings; see the early return.
| serde_json::to_vec(&json!({ | ||
| "version": 3, | ||
| "issuer": "https://postil.dev", | ||
| "token": "pcli_e2e-access-not-a-real-secret", |
There was a problem hiding this comment.
error · confidence 0.99 · kind: risk
Rotate this credential, purge it from git history because the commit is permanent otherwise, and move it to an environment variable or secrets store. Even test credentials can be reused if accepted by a service or copied into other environments.
There was a problem hiding this comment.
The cited value is an E2E fixture for the ignored stored-login path, while the test request uses a separate provider fixture. The updated test literal is generic; see the fixture setup.
| serde_json::to_vec(&json!({ | ||
| "version": 3, | ||
| "issuer": "https://postil.dev", | ||
| "token": "pcli_e2e-access-not-a-real-secret", |
There was a problem hiding this comment.
error · confidence 0.99 · kind: risk
This fixture commits a credential-like access token, even if intended as a test value. Rotate the credential, purge it from git history (the commit is permanent otherwise), and move it to an environment variable or secrets store; use a clearly non-credential fixture value only after history cleanup.
There was a problem hiding this comment.
The cited value is an E2E fixture for the ignored stored-login path, while the test request uses a separate provider fixture. The updated test literal is generic; see the fixture setup.
There was a problem hiding this comment.
2 findings posted inline
2 suppressed
- Remove and rotate the committed access token at
tests/e2e.rs:1402: restates a retained finding about another location; severity error, confidence 0.99. This access token is committed to the repository, so it must be treated as exposed regardless of whether it is a fixture value. Rotate the credential, purge it from git history (the commit is permanent otherwise), and move it to an environment variable or secrets store. - Remove the committed credential-like token at
tests/e2e.rs:1451: restates a retained finding about another location; severity error, confidence 0.99. This token is committed in the repository, so treat it as exposed even if it is intended only for tests. Rotate the credential, purge it from git history because the commit is permanent otherwise, and move the value to an environment variable or secrets store.
Before the next push
Run postil review --staged.
| "version": 3, | ||
| "issuer": "https://postil.dev", | ||
| "token": "pcli_e2e-access-not-a-real-secret", | ||
| "token": "fixture-stored-login-token", |
There was a problem hiding this comment.
error · confidence 0.98 · kind: risk
A stored-login token is committed in test source. Rotate it, purge it from Git history, and replace the hard-coded value with an environment variable or secrets-store reference.
| serde_json::to_vec(&json!({ | ||
| "version": 3, | ||
| "issuer": "https://postil.dev", | ||
| "token": "pcli_e2e-access-not-a-real-secret", |
There was a problem hiding this comment.
error · confidence 0.99 · kind: risk
A credential-like access token is committed in test source. Rotate it, purge it from Git history, and replace the hard-coded value with an environment variable or secrets-store reference.
1 participant
Stored-login reviews now let the hosted service select model and reasoning settings, and warn when local overrides are ignored. Explicit provider API keys retain local BYOK controls.