fix: remove the hardcoded Kyma API key fallback from the sift cron - #100
Merged
Conversation
The route fell back to a literal Kyma key when KYMA_API_KEY was unset, which put a working key in a public repository. It now reads the environment only and returns a 500 if the variable is missing. Production already sets KYMA_API_KEY, so behaviour there does not change. Removing the literal does not revoke it: the value stays in git history and in forks, so the key itself must be rotated separately. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JjoE3dRyR4WnS3zjGkAAgS
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
src/app/api/cron/sift/route.tsfell back to a literal Kyma API key whenKYMA_API_KEYwas unset. That put a working key in a public repository.This change reads the environment only, and the route returns a
500with a clear message if the variable is missing.Why it is safe to merge
KYMA_API_KEYin Production, so the live cron keeps working.npx tsc --noEmitpasses, same asmain.What this does not do
Removing the literal does not revoke the key. The value remains in git history and in the repository's forks, so the key has to be rotated in Kyma separately. That is tracked outside this PR.
🤖 Generated with Claude Code
https://claude.ai/code/session_01JjoE3dRyR4WnS3zjGkAAgS