Security: Exposed API Key Detected (anthropic)

[theluckystrike]

Security Notice: Exposed API Key Detected

Hi there! This is an automated, good-faith security notification.

This repository appears to contain an exposed ANTHROPIC API key that could lead to unauthorized charges on your account.

Details

Field	Value
File	src/thinker/anthropic.rs
Key Type	Anthropic Key Literal
Severity	CRITICAL
Cost Risk	Up to $1000s/day if abused. Claude API bills per token.
Detected	recently

Why This Matters

Exposed API keys in public repositories can be scraped by automated bots within minutes. Depending on the provider, this can result in:

• Unauthorized API usage billed to your account
• Potential data access through your API credentials
• Account suspension by the provider

Recommended Actions

1. Rotate the key immediately in your provider's dashboard
2. Remove the key from your codebase history (note: simply deleting from the latest commit is NOT enough - use BFG Repo-Cleaner or git filter-branch)
3. Use environment variables or a secrets manager going forward
4. Add .env to your .gitignore
5. Enable GitHub Secret Scanning in your repository settings
6. Check your billing dashboard for any unauthorized usage

Prevention Resources

• GitHub Secret Scanning
• git-secrets by AWS Labs
• Gitleaks
• pre-commit hooks for catching secrets before commit

About This Notification

This notice was generated by KeyScout, an open-source ethical security scanner. The goal is to help developers protect themselves from unexpected API charges. No keys were tested, validated, or used in any way. Only the presence of key-like patterns in public code was detected.

If this is a false positive (e.g., a revoked key kept for documentation), feel free to close this issue. Stay safe! 🛡️