NousResearch/hermes-agent
Webhook and API key secrets config.yaml exposure
Cluster 77471 · gateway. Data as of
2 open items. Fix attempted, not merged.
The short answer
1open issue
1open PR
3items grouped
- Known?
- Yes. 3 related items grouped here, 0 issues already closed.
- Fix event
- No fix has been merged to main. 1 PR closed without merging; see the attempts below.
- Tracker
- The maintainers' tracker marks this
unresolved. That is separate from the fix event. - Still open
- 1 issue and 1 PR.
Next step: read the attempts below. Your case may extend or revive that work.
Pick up a Lab taskThese items address a security concern where webhook secrets and model API keys are being stored in plaintext inside config.yaml instead of being kept exclusively in environment variables or secure references. The work involves identifying the violation and changing how secrets are stored or referenced.
Open issues1
- Issue#77471fix(security): WEBHOOK_SECRET and model API keys land in plaintext config.yaml, violating the .env-only-secrets rule
Open PRs1
- PR#78086fix(security): keep webhook and model API keys out of config.yaml
1 PR closed without merging
From the close comments: done elsewhere 1
-
#85025 fix(security): store webhook secrets by reference and migrate plaintext · done elsewhere →
5b50133,e60983a
How this cluster was grouped
-
Link evidence (
structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference. -
Pairwise link density
0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36.1.00means every pair is linked.
Pick up a Lab task
Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.
Open the LabAt a glance
- Subsystem
- gateway
- Closed issues
- 0
- Attempts
- 1 PR closed without merging