From 8155b30c63564cb2b389b22905810e5f3a82977c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 14 Jul 2026 06:31:18 +0000
Subject: [PATCH] fix(openrouter): stop logging API key material, use a hash
 fingerprint

Address Codex review: the debug log previously included the key's
first 10 characters. Replace with a non-reversible SHA-256 fingerprint
so logs remain useful for correlating support reports without ever
exposing key material.
---
 server/services/openrouter.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/services/openrouter.ts b/server/services/openrouter.ts
index 073e7d8..2137458 100644
--- a/server/services/openrouter.ts
+++ b/server/services/openrouter.ts
@@ -12,6 +12,7 @@ interface GeneratedText {
   characterCount: number;
 }
 
+import crypto from 'crypto';
 import { storage } from '../storage';
 
 export class OpenRouterService {
@@ -35,8 +36,8 @@ export class OpenRouterService {
     // Use provided model or fall back to config model
     const modelToUse = modelOverride || config.model;
 
-    const keyPreview = `${config.apiKey.slice(0, 10)}...(len=${config.apiKey.length})`;
-    console.log(`[OpenRouter] Generating with model="${modelToUse}" key=${keyPreview} configUserId=${config.userId}`);
+    const keyFingerprint = crypto.createHash('sha256').update(config.apiKey).digest('hex').slice(0, 8);
+    console.log(`[OpenRouter] Generating with model="${modelToUse}" keyFingerprint=${keyFingerprint} keyLength=${config.apiKey.length} configUserId=${config.userId}`);
 
     try {
       const response = await fetch(this.baseUrl, {