---
title: "ConfigGuard and the code verifier miss…"
description: "GHSA-64xf-wffc-63fm: ConfigGuard and the code verifier miss project-scoped OpenAI API keys (sk-proj-). Affected and fixed versions of qwed."
url: https://qwedai.tech/security/advisories/ghsa-64xf-wffc-63fm
---

GHSA-64xf-wffc-63fm

# ConfigGuard and the code verifier miss project-scoped OpenAI API keys (sk-proj-)

medium · 5.3 Published 13 October 2026

## Impact

`ConfigGuard` looks for OpenAI keys with the pattern `sk-[a-zA-Z0-9]{20,}` (`qwed_sdk/guards/config_guard.py`). That pattern does not allow a `-` after `sk-`, so it never matches current project-scoped keys (`sk-proj-...`). A configuration containing such a key is reported as `verified: True`, "No secrets detected in configuration."

The secret check in `CodeVerifier` (`src/qwed_new/core/code_verifier.py`, `sk-[a-zA-Z0-9]{48}`) has the same gap.

Applications that rely on these checks to stop secrets from being committed, logged or sent to a model will let these keys through.

`PIIGuard` (`src/qwed_new/guards/pii_guard.py`) already uses a pattern that matches them, `sk-(proj-)?[\w-]{20,}`.

## Proof of concept

```python
from qwed_sdk.guards.config_guard import ConfigGuard

fake_key = "sk-proj-" + "Ab3dEf6hIj9kLm2nOp5qRs8tUv1wXy4z"   # synthetic value
print(ConfigGuard().verify_config_safety({"OPENAI_API_KEY": fake_key}))
# {'verified': True, 'message': 'No secrets detected in configuration.'}
```

## Patches

Fixed in 7.2.3. The OpenAI patterns in ConfigGuard and the code verifier now match `sk-proj-`, `sk-svcacct-` and `sk-admin-` keys, in line with PIIGuard.

## Workarounds

Until you upgrade, add the pattern yourself:

```python
ConfigGuard(custom_patterns={"OPENAI_PROJECT_KEY": r"sk-(?:proj|svcacct|admin)-[\w-]{20,}"})
```

Affected and fixed

Package

qwed

Affected

\>= 3.0.0, <= 7.2.2

Fixed in

7.2.3

Severity

medium · 5.3

Weakness

CWE-184 Incomplete List of Disallowed Inputs

Credits

[@rahuldass19](https://github.com/rahuldass19)

[View on GitHub](https://github.com/QWED-AI/qwed-verification/security/advisories/GHSA-64xf-wffc-63fm)

[All advisories](https://qwedai.tech/security/advisories)