scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-12 23:01:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 89
litellm/enterprise/litellm_enterprise/enterprise_callbacks
History
Exact
yucheng-berri a0058ed157
fix(hide-secrets): stop redacting benign identifiers (#39879) 
* fix(hide-secrets): stop redacting benign identifiers and make redaction deterministic

The OpenAI key detector matched `sk-` anywhere inside a word, so `<task-notification>`
became `<ta[REDACTED]>`, and the Base64 entropy limit of 3.0 flagged ordinary quoted
identifiers such as `"application/json"` and model ids. Redaction also iterated a
hash-seeded set, so the same request produced different bytes on different workers and
broke prompt caching.

- require a standalone `sk-`/`sk_` token with a digit (still catches sk-proj-/sk-ant-)
- raise Base64HighEntropyString limit from 3.0 to the detect-secrets default 4.5
- redact overlapping matches longest-first in a stable order

Resolves LIT-7049

* fix(hide-secrets): treat separators as key boundaries and defer sk_live_ to the stripe detector

The standalone-token boundary also rejected keys glued to a preceding `_`, `-`
or percent-encoded delimiter (`openai_sk-…`, `key-sk-…`, `Bearer%20sk-…`), which
the old pattern redacted, and `sk_live_…` was counted by both the OpenAI and the
Stripe detector.

* fix(hide-secrets): keep the openai key scan linear on repeated sk separators

The digit requirement was a lookahead, so every `sk` inside a long
`[a-zA-Z0-9_-]` run re-scanned the rest of that run looking for a digit.
100 KB of `-sk-` took over 5s in the worker's event loop and the proxy
closed the connection without a response. The check now runs once per
match in `analyze_string` instead.

* chore(hide-secrets): remove redundant performance test comment

* fix(hide-secrets): consume complete openai key tokens

* chore(hide-secrets): remove redundant fixture comment

* chore(hide-secrets): remove redundant test docstrings

* fix(hide-secrets): redact whole stripe live keys

* style(hide-secrets): wrap secret sorting key
2026-09-05 11:47:36 -07:00
..
pagerduty fix(lint): bring basedpyright rule counts back under their budget limits 2026-08-05 10:23:02 -07:00
secrets_plugins fix(hide-secrets): stop redacting benign identifiers (#39879) 2026-09-05 11:47:36 -07:00
send_emails fix(email): stop duplicate legacy invitation email and fix its onboarding link (#36455) 2026-08-10 23:26:27 -07:00
__init__.py fix(lint): bring basedpyright rule counts back under their budget limits 2026-08-05 10:23:02 -07:00
callback_controls.py [Feat] AI Gateway - Allow admins to disable, dynamic callback controls (#16750) 2025-11-17 18:29:07 -08:00
example_logging_api.py [Refactor] Use pip package for enterprise/ folder (#10709) 2025-05-09 17:18:48 -07:00
llama_guard.py feat(audio_transcriptions/): calculate duration of audio file for cost calculation + feat (image_generations): cost tracking accuracy improved with output_format, quality, size values fixed per openai model 2025-11-08 16:24:31 -08:00
llm_guard.py fix(llm_guard): apply sanitized prompt returned by moderation API to request (#33331) 2026-07-16 01:27:44 +03:00
secret_detection.py fix(hide-secrets): stop redacting benign identifiers (#39879) 2026-09-05 11:47:36 -07:00