API keys exposed in plaintext via /api/config endpoint

[mango766]

Hi,

The GET /api/config endpoint returns all configuration values in plaintext, including API keys like INSIGHT_ENGINE_API_KEY, MEDIA_ENGINE_API_KEY, etc. There's no authentication on this endpoint, so anyone with network access can read (and write via POST) the full config.

This was also reported in #620 — it looks like a number of deployments have already been affected.

As a first step, I think masking the sensitive values in the GET response would help. I've got a fix that replaces API key values with masked versions (e.g., ***abcd) so the frontend can still show that a key is configured without exposing the actual value.

A more complete fix would add authentication to these endpoints, but that's a bigger change — happy to discuss.

[dosubot]

Hi, @mango766. I'm Dosu, and I'm helping the 666ghj/BettaFish team manage their backlog and am marking this issue as stale.

Issue Summary:

• You reported that the GET /api/config endpoint exposes all configuration values, including sensitive API keys, in plaintext without authentication.
• You recommended masking API key values in the response as a quick fix.
• You also suggested implementing authentication on these endpoints for a more secure, long-term solution.
• No further comments or updates have been made on this issue so far.

Next Steps:

• Please let us know if this issue is still relevant to the latest version of 666ghj/BettaFish by commenting here.
• If we do not hear back within 7 days, this issue will be automatically closed.

Thank you for your understanding and contribution!