hardening: key-hygiene guard — warn on secret-like fields in config.json, ignore .env*/keys

Author: TinyCode

.gitignore

@@ -3,3 +3,10 @@ dist/
 .tmp/
 *.log
 .DS_Store
+
+# secrets & local credentials — never commit
+.env
+.env.*
+*.pem
+*.key
+.tinycode/*.local.json

README.md

@@ -162,6 +162,10 @@ TinyCode's permission system is an **approval layer + workspace path guard, not
 - Shell commands pass a risk classifier plus the same approval flow; they are not confined —
   an approved `bash` call can do anything your user can.
 - Running genuinely untrusted code/tasks requires an external sandbox (container, VM).
+- **API keys live in environment variables only.** `.gitignore` already excludes
+  `.env*`, `*.key`, `*.pem` and `.tinycode/*.local.json`; if a secret-looking field
+  appears in `.tinycode/config.json` (which is meant to be committed), startup prints
+  a loud warning.
 
 ## Documentation
 

src/cli/commands.ts

@@ -64,7 +64,10 @@ export async function buildHarnessFromCli(options: {
   mock: boolean;
   session?: { mode: "new" } | { mode: "attach"; id: string };
 }): Promise<Harness> {
-  const { config } = loadConfig(options.cwd);
+  const { config, warnings } = loadConfig(options.cwd);
+  for (const warning of warnings) {
+    process.stderr.write(`warning: ${warning}\n`);
+  }
   const modelRef = options.modelFlag ? parseModelRef(options.modelFlag) : undefined;
   const harness = await bootstrapHarness({
     projectRoot: options.cwd,

src/config/loader.ts

@@ -29,6 +29,29 @@ function parseModelRef(ref: string): { provider?: string; model?: string } {
   };
 }
 
+/**
+ * Defense against the classic accident: pasting an API key into config.json
+ * (which is safe to commit) and pushing it. Unknown to the schema by design —
+ * keys come from environment variables — so any secret-looking field is a mistake.
+ */
+const SECRET_FIELD_RE = /^(.*(?:api[_-]?key|apikey|secret|token|password|credential).*|sk-.*)$/i;
+
+function findSecretLikeFields(value: unknown, prefix = ""): string[] {
+  const hits: string[] = [];
+  if (Array.isArray(value)) return hits;
+  if (value !== null && typeof value === "object") {
+    for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {
+      const field = prefix ? `${prefix}.${key}` : key;
+      if (SECRET_FIELD_RE.test(key) || (typeof nested === "string" && /^sk-[A-Za-z0-9]/.test(nested))) {
+        hits.push(field);
+      } else {
+        hits.push(...findSecretLikeFields(nested, field));
+      }
+    }
+  }
+  return hits;
+}
+
 export interface LoadedConfig {
   config: TinyCodeConfig;
   /** Non-fatal problems: unreadable file, schema violations of unknown shape. */
@@ -47,7 +70,15 @@ export function loadConfig(projectRoot: string): LoadedConfig {
   const file = path.join(projectRoot, ".tinycode", "config.json");
   try {
     const raw = readFileSync(file, "utf8");
-    const parsed = configSchema.safeParse(JSON.parse(raw));
+    const json: unknown = JSON.parse(raw);
+    const secretFields = findSecretLikeFields(json);
+    if (secretFields.length > 0) {
+      warnings.push(
+        `${file} contains field(s) ${secretFields.map((f) => `"${f}"`).join(", ")} that look like API keys. ` +
+          `Keys are read from environment variables only; this file may be committed — remove secrets from it.`,
+      );
+    }
+    const parsed = configSchema.safeParse(json);
     if (parsed.success) {
       config = parsed.data;
     } else {

tests/config.test.ts

@@ -60,6 +60,28 @@ describe("config loader", () => {
     expect(config.permissionMode).toBe("auto");
   });
 
+  it("warns when config.json contains secret-looking fields", () => {
+    fs.mkdirSync(path.join(root, ".tinycode"));
+    fs.writeFileSync(
+      path.join(root, ".tinycode", "config.json"),
+      JSON.stringify({ provider: "openrouter", apiKey: "sk-or-v1-abc123", mcpServers: { s: { command: "x" } } }),
+    );
+    const { warnings } = loadConfig(root);
+    expect(warnings.join(" ")).toMatch(/look like API keys/);
+    expect(warnings.join(" ")).toContain('"apiKey"');
+    // The file itself must stay git-ignored-safe: schema still parses the rest.
+  });
+
+  it("warns on nested sk-prefixed values even with innocuous field names", () => {
+    fs.mkdirSync(path.join(root, ".tinycode"));
+    fs.writeFileSync(
+      path.join(root, ".tinycode", "config.json"),
+      JSON.stringify({ provider: "openrouter", note: "sk-v1-hidden-in-text" }),
+    );
+    const { warnings } = loadConfig(root);
+    expect(warnings.join(" ")).toMatch(/look like API keys/);
+  });
+
   it("ignores TINYCODE_MODEL=mock (handled by the registry)", () => {
     process.env.TINYCODE_MODEL = "mock";
     const { config } = loadConfig(root);