Skip to content

[Security] Extension stores OpenAI API key in sync storage accessible across devices #403

Closed as not planned
Closed as not planned
[Security] Extension stores OpenAI API key in sync storage accessible across devices#403
Assignees
Pratikshya32
Labels
component:aiComponent: AI/LLM integrationcomponent:storageComponent: Storage layergssocOfficial GSSoC contribution issuegssoc:approvedGSSoC: PR approved and scoredlevel:advancedDifficulty level: Advanced (55 pts)staletype:designType: Design / UI / UX (Optional bonus)

Description

@Pratikshya32
Pratikshya32
opened on Jun 1, 2026

Description

In src/utils/credentials.ts, the OpenAI API key may be stored in chrome.storage.sync which syncs across all Chrome devices linked to the user's Google account. If any of those devices are compromised, the API key is exposed.

Suggested Fix

  • Use chrome.storage.local (not sync) for sensitive API keys
  • Encrypt the key before storage using the Web Crypto API
  • Add a note in the UI warning users about API key sensitivity

cc @shouri123

Activity

  1. Pratikshya32 commented on Jun 1, 2026

    @Pratikshya32
    Pratikshya32
    on Jun 1, 2026
    ContributorAuthor

    /assign

  2. github-actions
    added
    gssocOfficial GSSoC contribution issue
    gssoc:approvedGSSoC: PR approved and scored
    type:designType: Design / UI / UX (Optional bonus)
    on Jun 1, 2026
  3. github-actions
    assigned
    Pratikshya32
    on Jun 1, 2026

  4. github-actions commented on Jun 1, 2026

    @github-actions
    github-actionsbot
    on Jun 1, 2026 – with GitHub Actions
    Contributor

    👋 Hi @Pratikshya32, thank you for opening this issue! I have automatically assigned this issue to you since you raised it.

    Please follow the contribution guidelines and submit a PR. Let us know if you need any assistance! 🚀

    Please consider starring the repository ⭐ to show your support!

  5. github-actions commented on Jun 1, 2026

    @github-actions
    github-actionsbot
    on Jun 1, 2026 – with GitHub Actions
    Contributor

    Hello @Pratikshya32! You have been assigned to this issue. 🚀

    Please make sure you have read our contribution guidelines. Happy coding!

    Please consider starring the repository ⭐ to show your support!

  6. shouri123
    added
    level:advancedDifficulty level: Advanced (55 pts)
    component:storageComponent: Storage layer
    component:aiComponent: AI/LLM integration
    on Jun 1, 2026

  7. github-actions commented on Jun 17, 2026

    @github-actions
    github-actionsbot
    on Jun 17, 2026 – with GitHub Actions
    Contributor

    This issue has been marked as stale due to inactivity.

  8. github-actions
    added
    stale
    on Jun 17, 2026
  9. github-actions
    closed this as not plannedon Jun 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

component:aiComponent: AI/LLM integrationcomponent:storageComponent: Storage layergssocOfficial GSSoC contribution issuegssoc:approvedGSSoC: PR approved and scoredlevel:advancedDifficulty level: Advanced (55 pts)staletype:designType: Design / UI / UX (Optional bonus)

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions