| name | env-key-guard |
| description | Guard rules for GROQ_API_KEY handling in ai_feedback.py and the .env file. Check before reading, printing, logging, or committing anything near the key. |
| user-invocable | false |
GROQ_API_KEY lives in .env (gitignored) and is read in ai_feedback.py via os.getenv("GROQ_API_KEY", ""). This repo is public on GitHub, so a leak here is a real leak.
- Never
cat, Read, or print .env. If you need to check the key exists, check os.getenv("GROQ_API_KEY") truthiness only — never its value.
- Never put the key value in a log line, commit message, error message, or code comment.
_log_ai_error already logs failures without the key — keep new error paths the same way.
- Never write the key into a file other than
.env (no hardcoding into ai_feedback.py, no committing a .env.example with a real value — placeholder only).
- Before any
git add/commit in this repo, confirm .env isn't staged (git status) — it's gitignored but a git add -f or path typo could still catch it.
ai_feedback.py::_load_environment() has a manual .env parser fallback for when python-dotenv isn't installed — if editing it, preserve that it skips comments/blank lines and never overwrites a var already set in os.environ.
