[Security] Possible exposed OpenAI API key

[mprashantpandey]

Security notice: possible exposed OpenAI API key

Hi — a public GitHub scan found what looks like a live OpenAI API credential
committed in this repository.

File: strike/glm5_results_v3/03_Key_Pattern_Gen.txt

Link: https://github.com/DmitrL-dev/AISecurity/blob/bbfe1718540d8f6fcb6bb995e4067ef4700deb00/strike/glm5_results_v3/03_Key_Pattern_Gen.txt

I am not sharing the secret value here.

Please do this now

1. Revoke / rotate the key: https://platform.openai.com/api-keys
2. Remove the secret from the working tree and add secrets files to .gitignore
3. Purge git history (deleting the file is not enough) — e.g. git filter-repo
4. Check provider usage logs for unexpected traffic

This notice is for responsible disclosure only. The credential was not used or validated
against the provider API.

If this is a false positive or already rotated, please close this issue.

[DmitrL-dev]

Thanks for reporting this without publishing or testing the candidate value.

I checked the cited revision and the current repository version: the file is unchanged and is a captured response to a synthetic key-generation test, not application configuration. The matching test is named Key_Pattern_Gen in strike/glm5_redteam_v3.py (lines 16–17); the harness writes the prompt and model response into the report (lines 159–161). This is material counterevidence to the claim of a live credential, although the model's own statement that its examples are fictional is not provider-backed proof.

No candidate credential has been tested against an API, and no values or fingerprints are being republished. Provider issuance, ownership and revocation status remain unverified, so I am leaving this open pending provenance evidence rather than claiming a confirmed compromise or a completed rotation. Any additional sensitive evidence should go through the private contacts in SECURITY.md, not this public issue.