fix: multiple api keys are hardcoded directly in the... in conversion.js

[anupamme]

Summary

Fix critical severity security issue in scs/conversion.js.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	scs/conversion.js:163
Assessment	Likely exploitable

Description: Multiple API keys are hardcoded directly in the source code, including Imgur Client-ID and Tenor/Google API key. Anyone with access to the source code can extract and abuse these keys to impersonate the application when calling external APIs.

Evidence

Exploitation scenario: Extract API keys from source code files and use them to make unauthorized requests to Imgur and Google APIs, potentially exhausting rate limits, incurring financial costs, or accessing premium.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• scs/conversion.js
• .env

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security