From aae13a051af856680cd3119199ebd883a93856e2 Mon Sep 17 00:00:00 2001 From: jacob-wang Date: Mon, 20 Apr 2026 20:40:20 +0800 Subject: [PATCH] fix: avoid printing partial Render API key in setup-deploy The previous `echo $RENDER_API_KEY | head -c 4` still leaked 4 bytes of the secret into terminal scrollback. Replace with a presence check that confirms whether the variable is set without exposing any bytes. Fixes #1078 Co-Authored-By: Claude Opus 4.7 --- setup-deploy/SKILL.md | 9 ++++++++- setup-deploy/SKILL.md.tmpl | 9 ++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/setup-deploy/SKILL.md b/setup-deploy/SKILL.md index 2d86f2bf9..380dc1294 100644 --- a/setup-deploy/SKILL.md +++ b/setup-deploy/SKILL.md @@ -856,7 +856,14 @@ Ask the user to confirm the production URL. Some Fly apps use custom domains. If `render.yaml` detected: 1. Extract service name and type from render.yaml -2. Check for Render API key: `echo $RENDER_API_KEY | head -c 4` (don't expose the full key) +2. Check for Render API key: +```bash +if [ -n "${RENDER_API_KEY:-}" ]; then + echo "RENDER_API_KEY: set" +else + echo "RENDER_API_KEY: not set" +fi +``` 3. Infer URL: `https://{service-name}.onrender.com` 4. Render deploys automatically on push to the connected branch — no deploy workflow needed 5. Set health check: the inferred URL diff --git a/setup-deploy/SKILL.md.tmpl b/setup-deploy/SKILL.md.tmpl index 587a993c0..6a1f79bc4 100644 --- a/setup-deploy/SKILL.md.tmpl +++ b/setup-deploy/SKILL.md.tmpl @@ -99,7 +99,14 @@ Ask the user to confirm the production URL. Some Fly apps use custom domains. If `render.yaml` detected: 1. Extract service name and type from render.yaml -2. Check for Render API key: `echo $RENDER_API_KEY | head -c 4` (don't expose the full key) +2. Check for Render API key: +```bash +if [ -n "${RENDER_API_KEY:-}" ]; then + echo "RENDER_API_KEY: set" +else + echo "RENDER_API_KEY: not set" +fi +``` 3. Infer URL: `https://{service-name}.onrender.com` 4. Render deploys automatically on push to the connected branch — no deploy workflow needed 5. Set health check: the inferred URL