Skip to content

feat: add validation for OpenAI API key and assistant ID in story poi…#409

Open
onurkanbakirci wants to merge 3 commits into
Trendyol:mainfrom
onurkanbakirci:develop-securit-vuln
Open

feat: add validation for OpenAI API key and assistant ID in story poi…#409
onurkanbakirci wants to merge 3 commits into
Trendyol:mainfrom
onurkanbakirci:develop-securit-vuln

Conversation

@onurkanbakirci

Copy link
Copy Markdown
Contributor

Missing API Key validation: gurubu-backend/services/openaiService.js uses process.env.OPENAI_API_KEY without checking if it exists

Missing Assistant ID validation: gurubu-backend/controllers/storyPointEstimationController.js uses process.env.OPENAI_ASSISTANT_ID without validation

@vercel

vercel Bot commented Sep 10, 2025

Copy link
Copy Markdown

@onurkanbakirci is attempting to deploy a commit to the Trendyol Gurubu Team Team on Vercel.

A member of the Team first needs to authorize it.

@mertcanaltin mertcanaltin left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

open api key is actually already read from vercel variables section

@onurkanbakirci

Copy link
Copy Markdown
Contributor Author

What about the Jira-related keys and P_GATEWAY_URL? I’ve also included them in the PR. @mertcanaltin

Comment on lines +8 to +10
if (!process.env.OPENAI_API_KEY) {
throw new Error('OPENAI_API_KEY environment variable is required');
}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In cases where there is no API, we should not interrupt the application with a throw; we can discuss a better approach, such as a catch scenario and a user-friendly flow.

@mertcanaltin

Copy link
Copy Markdown
Member

Please use a shorter and more appropriate commit message. Additionally, I agree that APIs are already stored as env values, so I don't think there's a major issue here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants