AI Fix Prompts for Cliproxyapiplus

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 476
**Severity**: CRITICAL

**Current code around the issue:**
```
     471 | 		errStr := c.Query("error")
     472 | 		if errStr == "" {
     473 | 			errStr = c.Query("error_description")
     474 | 		}
     475 | 		if state != "" {
>>>  476 | 			_, _ = managementHandlers.WriteOAuthCallbackFileForPendingSession(s.cfg.AuthDir, "kiro", state, code, errStr)
     477 | 		}
     478 | 		c.Header("Content-Type", "text/html; charset=utf-8")
     479 | 		c.String(http.StatusOK, oauthCallbackSuccessHTML)
     480 | 	})
     481 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 540
**Severity**: CRITICAL

**Current code around the issue:**
```
     535 | 
     536 | func (s *Server) registerManagementRoutes() {
     537 | 	if s == nil || s.engine == nil || s.mgmt == nil {
     538 | 		return
     539 | 	}
>>>  540 | 	if !s.managementRoutesRegistered.CompareAndSwap(false, true) {
     541 | 		return
     542 | 	}
     543 | 
     544 | 	log.Info("management routes registered after secret key configuration")
     545 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/access/config_access/provider.go
**Line**: 21
**Severity**: CRITICAL

**Current code around the issue:**
```
      16 | 		return
      17 | 	}
      18 | 
      19 | 	keys := normalizeKeys(cfg.APIKeys)
      20 | 	if len(keys) == 0 {
>>>   21 | 		sdkaccess.UnregisterProvider(sdkaccess.AccessProviderTypeConfigAPIKey)
      22 | 		return
      23 | 	}
      24 | 
      25 | 	sdkaccess.RegisterProvider(
      26 | 		sdkaccess.AccessProviderTypeConfigAPIKey,
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 462
**Severity**: CRITICAL

**Current code around the issue:**
```
     457 | 		errStr := c.Query("error")
     458 | 		if errStr == "" {
     459 | 			errStr = c.Query("error_description")
     460 | 		}
     461 | 		if state != "" {
>>>  462 | 			_, _ = managementHandlers.WriteOAuthCallbackFileForPendingSession(s.cfg.AuthDir, "antigravity", state, code, errStr)
     463 | 		}
     464 | 		c.Header("Content-Type", "text/html; charset=utf-8")
     465 | 		c.String(http.StatusOK, oauthCallbackSuccessHTML)
     466 | 	})
     467 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 490
**Severity**: CRITICAL

**Current code around the issue:**
```
     485 | 		errStr := c.Query("error")
     486 | 		if errStr == "" {
     487 | 			errStr = c.Query("error_description")
     488 | 		}
     489 | 		if state != "" {
>>>  490 | 			_, _ = managementHandlers.WriteOAuthCallbackFileForPendingSession(s.cfg.AuthDir, "cline", state, code, errStr)
     491 | 		}
     492 | 		c.Header("Content-Type", "text/html; charset=utf-8")
     493 | 		c.String(http.StatusOK, oauthCallbackSuccessHTML)
     494 | 	})
     495 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/access/config_access/provider.go
**Line**: 103
**Severity**: CRITICAL

**Current code around the issue:**
```
      98 | 				},
      99 | 			}, nil
     100 | 		}
     101 | 	}
     102 | 
>>>  103 | 	return nil, sdkaccess.NewInvalidCredentialError()
     104 | }
     105 | 
     106 | func extractBearerToken(header string) string {
     107 | 	if header == "" {
     108 | 		return ""
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/access/reconcile.go
**Line**: 39
**Severity**: CRITICAL

**Current code around the issue:**
```
      34 | 	}
      35 | 
      36 | 	finalIDs := make(map[string]struct{}, len(result))
      37 | 
      38 | 	isInlineProvider := func(id string) bool {
>>>   39 | 		return strings.EqualFold(id, sdkaccess.DefaultAccessProviderName)
      40 | 	}
      41 | 	appendChange := func(list *[]string, id string) {
      42 | 		if isInlineProvider(id) {
      43 | 			return
      44 | 		}
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/access/config_access/provider.go
**Line**: 27
**Severity**: CRITICAL

**Current code around the issue:**
```
      22 | 		return
      23 | 	}
      24 | 
      25 | 	sdkaccess.RegisterProvider(
      26 | 		sdkaccess.AccessProviderTypeConfigAPIKey,
>>>   27 | 		newProvider(sdkaccess.DefaultAccessProviderName, keys),
      28 | 	)
      29 | }
      30 | 
      31 | type provider struct {
      32 | 	name string
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/access/config_access/provider.go
**Line**: 39
**Severity**: CRITICAL

**Current code around the issue:**
```
      34 | }
      35 | 
      36 | func newProvider(name string, keys []string) *provider {
      37 | 	providerName := strings.TrimSpace(name)
      38 | 	if providerName == "" {
>>>   39 | 		providerName = sdkaccess.DefaultAccessProviderName
      40 | 	}
      41 | 	keySet := make(map[string]struct{}, len(keys))
      42 | 	for _, key := range keys {
      43 | 		keySet[key] = struct{}{}
      44 | 	}
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/access/config_access/provider.go
**Line**: 15
**Severity**: CRITICAL

**Current code around the issue:**
```
      10 | )
      11 | 
      12 | // Register ensures the config-access provider is available to the access manager.
      13 | func Register(cfg *sdkconfig.SDKConfig) {
      14 | 	if cfg == nil {
>>>   15 | 		sdkaccess.UnregisterProvider(sdkaccess.AccessProviderTypeConfigAPIKey)
      16 | 		return
      17 | 	}
      18 | 
      19 | 	keys := normalizeKeys(cfg.APIKeys)
      20 | 	if len(keys) == 0 {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/access/config_access/provider.go
**Line**: 50
**Severity**: CRITICAL

**Current code around the issue:**
```
      45 | 	return &provider{name: providerName, keys: keySet}
      46 | }
      47 | 
      48 | func (p *provider) Identifier() string {
      49 | 	if p == nil || p.name == "" {
>>>   50 | 		return sdkaccess.DefaultAccessProviderName
      51 | 	}
      52 | 	return p.name
      53 | }
      54 | 
      55 | func (p *provider) Authenticate(_ context.Context, r *http.Request) (*sdkaccess.Result, *sdkaccess.AuthError) {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/access/config_access/provider.go
**Line**: 26
**Severity**: CRITICAL

**Current code around the issue:**
```
      21 | 		sdkaccess.UnregisterProvider(sdkaccess.AccessProviderTypeConfigAPIKey)
      22 | 		return
      23 | 	}
      24 | 
      25 | 	sdkaccess.RegisterProvider(
>>>   26 | 		sdkaccess.AccessProviderTypeConfigAPIKey,
      27 | 		newProvider(sdkaccess.DefaultAccessProviderName, keys),
      28 | 	)
      29 | }
      30 | 
      31 | type provider struct {
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 304
**Severity**: CRITICAL

**Current code around the issue:**
```
     299 | 	// Register management routes when configuration or environment secrets are available,
     300 | 	// or when a local management password is provided (e.g. TUI mode).
     301 | 	hasManagementSecret := cfg.RemoteManagement.SecretKey != "" || envManagementSecret || s.localPassword != ""
     302 | 	s.managementRoutesEnabled.Store(hasManagementSecret)
     303 | 	if hasManagementSecret {
>>>  304 | 		s.registerManagementRoutes()
     305 | 	}
     306 | 
     307 | 	// === CLIProxyAPIPlus 扩展: 注册 Kiro OAuth Web 路由 ===
     308 | 	kiroOAuthHandler := kiro.NewOAuthWebHandler(cfg)
     309 | 	kiroOAuthHandler.RegisterRoutes(engine)
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 332
**Severity**: CRITICAL

**Current code around the issue:**
```
     327 | func (s *Server) setupRoutes() {
     328 | 	s.engine.GET("/healthz", func(c *gin.Context) {
     329 | 		c.JSON(http.StatusOK, gin.H{"status": "ok"})
     330 | 	})
     331 | 
>>>  332 | 	s.engine.GET("/management.html", s.serveManagementControlPanel)
     333 | 	openaiHandlers := openai.NewOpenAIAPIHandler(s.handlers)
     334 | 	geminiHandlers := gemini.NewGeminiAPIHandler(s.handlers)
     335 | 	geminiCLIHandlers := gemini.NewGeminiCLIAPIHandler(s.handlers)
     336 | 	claudeCodeHandlers := claude.NewClaudeCodeAPIHandler(s.handlers)
     337 | 	openaiResponsesHandlers := openai.NewOpenAIResponsesAPIHandler(s.handlers)
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 392
**Severity**: CRITICAL

**Current code around the issue:**
```
     387 | 		errStr := c.Query("error")
     388 | 		if errStr == "" {
     389 | 			errStr = c.Query("error_description")
     390 | 		}
     391 | 		if state != "" {
>>>  392 | 			_, _ = managementHandlers.WriteOAuthCallbackFileForPendingSession(s.cfg.AuthDir, "anthropic", state, code, errStr)
     393 | 		}
     394 | 		c.Header("Content-Type", "text/html; charset=utf-8")
     395 | 		c.String(http.StatusOK, oauthCallbackSuccessHTML)
     396 | 	})
     397 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 406
**Severity**: CRITICAL

**Current code around the issue:**
```
     401 | 		errStr := c.Query("error")
     402 | 		if errStr == "" {
     403 | 			errStr = c.Query("error_description")
     404 | 		}
     405 | 		if state != "" {
>>>  406 | 			_, _ = managementHandlers.WriteOAuthCallbackFileForPendingSession(s.cfg.AuthDir, "codex", state, code, errStr)
     407 | 		}
     408 | 		c.Header("Content-Type", "text/html; charset=utf-8")
     409 | 		c.String(http.StatusOK, oauthCallbackSuccessHTML)
     410 | 	})
     411 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 420
**Severity**: CRITICAL

**Current code around the issue:**
```
     415 | 		errStr := c.Query("error")
     416 | 		if errStr == "" {
     417 | 			errStr = c.Query("error_description")
     418 | 		}
     419 | 		if state != "" {
>>>  420 | 			_, _ = managementHandlers.WriteOAuthCallbackFileForPendingSession(s.cfg.AuthDir, "gitlab", state, code, errStr)
     421 | 		}
     422 | 		c.Header("Content-Type", "text/html; charset=utf-8")
     423 | 		c.String(http.StatusOK, oauthCallbackSuccessHTML)
     424 | 	})
     425 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 434
**Severity**: CRITICAL

**Current code around the issue:**
```
     429 | 		errStr := c.Query("error")
     430 | 		if errStr == "" {
     431 | 			errStr = c.Query("error_description")
     432 | 		}
     433 | 		if state != "" {
>>>  434 | 			_, _ = managementHandlers.WriteOAuthCallbackFileForPendingSession(s.cfg.AuthDir, "gemini", state, code, errStr)
     435 | 		}
     436 | 		c.Header("Content-Type", "text/html; charset=utf-8")
     437 | 		c.String(http.StatusOK, oauthCallbackSuccessHTML)
     438 | 	})
     439 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 448
**Severity**: CRITICAL

**Current code around the issue:**
```
     443 | 		errStr := c.Query("error")
     444 | 		if errStr == "" {
     445 | 			errStr = c.Query("error_description")
     446 | 		}
     447 | 		if state != "" {
>>>  448 | 			_, _ = managementHandlers.WriteOAuthCallbackFileForPendingSession(s.cfg.AuthDir, "iflow", state, code, errStr)
     449 | 		}
     450 | 		c.Header("Content-Type", "text/html; charset=utf-8")
     451 | 		c.String(http.StatusOK, oauthCallbackSuccessHTML)
     452 | 	})
     453 | 
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Fix a hardcoded credential in repository 'HsnSaboor__CLIProxyAPIPlus'.

**Issue**: Hard-coded api_key found (Vault Token)
**File**: internal/api/server.go
**Line**: 547
**Severity**: CRITICAL

**Current code around the issue:**
```
     542 | 	}
     543 | 
     544 | 	log.Info("management routes registered after secret key configuration")
     545 | 
     546 | 	mgmt := s.engine.Group("/v0/management")
>>>  547 | 	mgmt.Use(s.managementAvailabilityMiddleware(), s.mgmt.Middleware())
     548 | 	{
     549 | 		mgmt.GET("/usage", s.mgmt.GetUsageStatistics)
     550 | 		mgmt.GET("/usage/export", s.mgmt.ExportUsageStatistics)
     551 | 		mgmt.POST("/usage/import", s.mgmt.ImportUsageStatistics)
     552 | 		mgmt.GET("/config", s.mgmt.GetConfig)
```

**Required fix:**
1. Remove the hardcoded credential from the source code
2. Replace it with an environment variable read: `os.environ.get('API_KEY_KEY')` (Python) or `process.env.API_KEY_KEY` (JS)
3. Add the variable name to a `.env.example` file with a placeholder value
4. Ensure `.env` is in `.gitignore`
5. If this credential was ever committed to git, it should be considered compromised and rotated

**Do NOT:**
- Move the secret to a config file that gets committed
- Use a default fallback value that is a real credential
- Leave the old credential in a comment

Address OWASP A02 (Cryptographic Failures) compliance gap in 'HsnSaboor__CLIProxyAPIPlus'.

**OWASP Category**: A02 -- Cryptographic Failures
**Fix guidance**: Remove hardcoded secrets, use strong encryption (AES-256-GCM), enforce TLS, never store passwords in plaintext (use bcrypt/argon2).

**Steps:**
1. Identify all code paths related to cryptographic failures
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Address OWASP A07 (Auth Failures) compliance gap in 'HsnSaboor__CLIProxyAPIPlus'.

**OWASP Category**: A07 -- Auth Failures
**Fix guidance**: Implement proper session management, use MFA where possible, enforce strong passwords, protect against brute force.

**Steps:**
1. Identify all code paths related to auth failures
2. Apply the fixes described above
3. Add automated tests to verify the fix
4. Document any security assumptions in code comments

Repository 'HsnSaboor__CLIProxyAPIPlus' is failing the quality gate.

Failed conditions:
- critical_credentials: actual 77.0 <= 0 (FAILED)

Fix each failing condition to make the repo pass the quality gate.

Repository 'HsnSaboor__CLIProxyAPIPlus' has 10 open issues:

- [CRITICAL] Hard-coded api_key: Vault Token (internal/api/server.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/access/config_access/provider.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/access/config_access/provider.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/access/config_access/provider.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/access/config_access/provider.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/access/config_access/provider.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/access/reconcile.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/access/config_access/provider.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/access/config_access/provider.go)
- [CRITICAL] Hard-coded api_key: Vault Token (internal/api/server.go)

Resolve each issue. For security issues, apply the appropriate fix. For quality issues, refactor the affected code.

These files in 'HsnSaboor__CLIProxyAPIPlus' have high cyclomatic complexity:

- **internal/runtime/executor/antigravity_executor.go**: complexity=575, max nesting=9, longest function=155 lines
- **internal/runtime/executor/claude_executor.go**: complexity=502, max nesting=9, longest function=119 lines
- **internal/runtime/executor/github_copilot_executor.go**: complexity=389, max nesting=8, longest function=219 lines
- **internal/runtime/executor/cursor_executor.go**: complexity=370, max nesting=11, longest function=119 lines
- **internal/registry/model_registry.go**: complexity=352, max nesting=7, longest function=166 lines

For each file:
1. Break large functions into smaller, focused functions
2. Reduce nesting depth (extract early returns, use guard clauses)
3. Simplify conditional logic
4. Extract complex expressions into named variables