-9

Remove API keys automatically

Over the last few days, I have had multiple questions that have included their API keys in their code.

Perfect example:

Just today I edited a post that had payment authentication keys...

Obviously most people aren't going to do anything bad with them, but since they are available to anyone on the world wide web, I think they should be removed.

How to do it?

I have seen other websites that convert serial numbers, usernames, keys, ect... into XXXXXX.

My questions:

  • Should this be done?
  • How would you tell API keys apart from other code or hashes?
  • Should SO maybe give a warning when users are asking a question?

Following questions suggested as related in comments are not covering topic in this feature request:

8

1 Answer 1

19

Should this be done?

No.

How would you tell API keys apart from other code or hashes?

Exactly. How would you do that? if you get it wrong (and I'm pretty confident SE get things wrong) you'll be removing crucial info, rendering a valid question useless / unintelligible .

Should SO maybe give a warning when users are asking a question?

We already give plenty of info, warnings, guidance that is happily ignored or confusing. Let's not add more bells and whistles for cases that need manual human intervention anyway. Because secrets should not come near a public website. That is something we can't fix. Let's not pretend we can.

5
  • "and I'm pretty confident SE get things wrong" xD
    – Seth B
    Commented Feb 16, 2021 at 17:59
  • I honestly don't know how some of these posters have made it as far as they have on their coding... It's like "I need help with my email server using JS to send people invoices." and their code has something like var email = [email protected]; var password = "My Very Secret Password"; SMH
    – Seth B
    Commented Feb 16, 2021 at 18:05
  • 3
    With a bit of luck they pushed it on their public github repo as well ...
    – rene
    Commented Feb 16, 2021 at 18:07
  • As for the email, that might get caught by the Smoke Detector as spam but only after it is posted. And once posted its indexed by Google.
    – rene
    Commented Feb 16, 2021 at 18:09
  • The other day someone posted this: "I want to code web browser with HTML, CSS, and JavaScript, and do it with no external libraries and no errors. I already tried searching online and couldn't find anything."
    – Seth B
    Commented Feb 16, 2021 at 18:10

Not the answer you're looking for? Browse other questions tagged .