litellm/enterprise
yucheng-berri a0058ed157
fix(hide-secrets): stop redacting benign identifiers (#39879)
* fix(hide-secrets): stop redacting benign identifiers and make redaction deterministic

The OpenAI key detector matched `sk-` anywhere inside a word, so `<task-notification>`
became `<ta[REDACTED]>`, and the Base64 entropy limit of 3.0 flagged ordinary quoted
identifiers such as `"application/json"` and model ids. Redaction also iterated a
hash-seeded set, so the same request produced different bytes on different workers and
broke prompt caching.

- require a standalone `sk-`/`sk_` token with a digit (still catches sk-proj-/sk-ant-)
- raise Base64HighEntropyString limit from 3.0 to the detect-secrets default 4.5
- redact overlapping matches longest-first in a stable order

Resolves LIT-7049

* fix(hide-secrets): treat separators as key boundaries and defer sk_live_ to the stripe detector

The standalone-token boundary also rejected keys glued to a preceding `_`, `-`
or percent-encoded delimiter (`openai_sk-…`, `key-sk-…`, `Bearer%20sk-…`), which
the old pattern redacted, and `sk_live_…` was counted by both the OpenAI and the
Stripe detector.

* fix(hide-secrets): keep the openai key scan linear on repeated sk separators

The digit requirement was a lookahead, so every `sk` inside a long
`[a-zA-Z0-9_-]` run re-scanned the rest of that run looking for a digit.
100 KB of `-sk-` took over 5s in the worker's event loop and the proxy
closed the connection without a response. The check now runs once per
match in `analyze_string` instead.

* chore(hide-secrets): remove redundant performance test comment

* fix(hide-secrets): consume complete openai key tokens

* chore(hide-secrets): remove redundant fixture comment

* chore(hide-secrets): remove redundant test docstrings

* fix(hide-secrets): redact whole stripe live keys

* style(hide-secrets): wrap secret sorting key
2026-09-05 11:47:36 -07:00
..
cloudformation_stack (fix) litellm cloud formation stack 2024-03-07 18:06:59 -08:00
dist BUMP Enterprise PIP 2026-02-14 13:40:48 -08:00
enterprise_hooks fix(proxy): scan batch records with the content hooks that are not guardrails (#37786) 2026-08-21 11:20:23 -07:00
enterprise_ui Update README.md 2024-02-21 22:11:39 -08:00
litellm_enterprise fix(hide-secrets): stop redacting benign identifiers (#39879) 2026-09-05 11:47:36 -07:00
__init__.py (fix) error cli users see when importing enterprise folder 2024-03-15 08:10:45 -07:00
LICENSE.md docs: document new github + gitlab ci scripts 2026-03-25 20:17:10 -07:00
pyproject.toml bump: litellm-enterprise 0.1.64 -> 0.1.65, litellm-proxy-extras 0.4.93 -> 0.4.94 2026-09-05 09:58:44 -07:00
README.md Fix enterprise doc link (#31815) 2026-07-09 11:48:11 -07:00

LiteLLM Enterprise

Code in this folder is licensed under a commercial license. Please review the LICENSE file within the /enterprise folder

These features are covered under the LiteLLM Enterprise contract

👉 Using in an Enterprise / Need specific features ? Meet with us here

See all Enterprise Features here 👉 Docs