ConfigGuard and the code verifier miss project-scoped OpenAI API keys (sk-proj-)

Impact

ConfigGuard looks for OpenAI keys with the pattern sk-[a-zA-Z0-9]{20,} (qwed_sdk/guards/config_guard.py). That pattern does not allow a - after sk-, so it never matches current project-scoped keys (sk-proj-...). A configuration containing such a key is reported as verified: True, "No secrets detected in configuration."

The secret check in CodeVerifier (src/qwed_new/core/code_verifier.py, sk-[a-zA-Z0-9]{48}) has the same gap.

Applications that rely on these checks to stop secrets from being committed, logged or sent to a model will let these keys through.

PIIGuard (src/qwed_new/guards/pii_guard.py) already uses a pattern that matches them, sk-(proj-)?[\w-]{20,}.

Proof of concept

from qwed_sdk.guards.config_guard import ConfigGuard

fake_key = "sk-proj-" + "Ab3dEf6hIj9kLm2nOp5qRs8tUv1wXy4z"   # synthetic value
print(ConfigGuard().verify_config_safety({"OPENAI_API_KEY": fake_key}))
# {'verified': True, 'message': 'No secrets detected in configuration.'}

Patches

Fixed in 7.2.3. The OpenAI patterns in ConfigGuard and the code verifier now match sk-proj-, sk-svcacct- and sk-admin- keys, in line with PIIGuard.

Workarounds

Until you upgrade, add the pattern yourself:

ConfigGuard(custom_patterns={"OPENAI_PROJECT_KEY": r"sk-(?:proj|svcacct|admin)-[\w-]{20,}"})