Store provider credentials as SecretStr in model configs - #1326
Merged
Conversation
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
LiteLLMModelConfig.api_key and TGIModelConfig.inference_server_auth were plain str fields, which meant they were retained in plaintext wherever a model config gets serialized (e.g. EvaluationTracker.results). Switch both to pydantic SecretStr, which masks the value in reprs and default serialization, and additionally exclude them explicitly when building the results dict as a second layer. The real value is still unwrapped via get_secret_value() at the specific call sites that need it for the actual outgoing request. Added regression tests asserting the credential never appears in the serialized results dict. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
JudgeLM.api_key was a plain str consumed directly by several backend clients (OpenAI, AsyncInferenceClient, litellm). Wrap it in SecretStr on assignment and unwrap via get_secret_value() at each usage site, for consistency with the other model configs and to remove any reliance on incidental string formatting to keep it out of logs or serialized output. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Unrelated cleanup so CI's Quality check is green on this branch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
NathanHB
force-pushed
the
fix/litellm-api-key-leak
branch
from
August 10, 2026 13:42
dc962a2 to
50ac35c
Compare
NathanHB
changed the title
Mandark-droid
added a commit
to Mandark-droid/every_eval_ever
that referenced
this pull request
Aug 12, 2026
…d and we missed huggingface/lighteval#1326 (merged today) made LiteLLMModelConfig.api_key a SecretStr and excluded BOTH api_key and inference_server_auth at the dump site. This converter's redaction knew about the first and not the second: matching is on exact names plus the suffixes _key/_token/_secret/_password/_credentials, none of which catch a field ending in _auth. So inference_server_auth was serialised into additional_details, which is published. The upstream fix does not make this guard redundant. Every results file written before it still holds the value in cleartext, and archived results files are precisely what a converter is pointed at. Adds the _auth suffix plus the exact names auth and inference_server_auth. The suffix is now value-aware, because widening it turned up a false positive in the first test written for it: requires_auth ends in _auth but a boolean cannot carry a secret, and redacting it would delete provenance for nothing. Exact names still redact whatever they hold; a suffix match requires a value a credential could actually be, and anything not positively known to be harmless still redacts -- a missed credential in a published record is unrecoverable, an over-redacted setting is not. Two tests: one pins inference_server_auth (and that the server ADDRESS, which is provenance rather than a credential, survives), one pins that requires_auth and authorized_users are not swallowed. 459 passed, 20 skipped; ruff clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Model configs (LiteLLM, TGI) and the LLM-as-judge client held API credentials as plain
strfields, so they were retained in plaintext wherever a config gets serialized (e.g.EvaluationTracker.results).Switch these fields to pydantic
SecretStr, which masks the value in reprs and default serialization, and additionally exclude them explicitly when building the results dict as a second layer. The real value is still unwrapped viaget_secret_value()at the specific call sites that need it for the actual outgoing request.Added regression tests asserting the credentials never appear in the serialized results dict.