3 ms·
Seems like you are leaking an ElevenLabs API key in your web demo. The OpenAI completions endpoint also has the API key in the request header but that seems to
by mnafees 7mo ago
Seems like you are leaking an ElevenLabs API key in your web demo. The OpenAI completions endpoint also has the API key in the request header but that seems to already be revoked and is returning a 401.
- shubham2802 7mo agoI am pretty sure we don't have balance. It's a bait :)
- neya 7mo agoSorry, but, this is not really a confidence inspiring response. Accepting the mistake and fixing the leak altogether would have been the better way to handle this. This is a developer forum, we all make mistakes. Framing it as bait just sounds like bad PR management. How can we trust your product if you can't fulfil basic security 101? Not being harsh but this kind of lax response for a serious mistake is not acceptable to me. Imagine I recommend you to my company and you end up leaking out our credentials and respond with something like this. I might be picky here about this, but long term trust starts with accountability. All the best on your product launch and cheers.
- shubham2802 7mo agoI see, sure will fix it asap. Again, thanks for feedback.
- gigatexal 7mo agoYeah wow. These responses to constructive feedback show an immature team full of hubris. This whole thing is DOA to me. Thank you HN for showing me this.
- shubham2802 7mo agomy earlier reply was too glib. Even though the key had no usable balance, it still should not have been exposed. We’re removing it now and fixing the demo flow so this doesn’t happen again. Thanks for calling it out. Cheers!
- word_saladist 7mo agoThis is pretty far off from being an intelligible sentence. I wonder if it’s a symptom of people getting used to LLMs being able to parse intent and meaning from fragmentary, disjointed text such as this.
- neya 7mo agoNo worries, like I said, we all make mistakes. Live and learn. All the best.
- mnafees 7mo agoHey Shubham, I can still see the API keys in https://www.runanywhere.ai/web-demo https://www.runanywhere.ai/web-demo, FWIW. A simple proxy of the request from the frontend to your own API and then to the vendor API would solve this. Also recommend rate limiting on the same. Happy to help if you need further assistance.