# Desk log AK-VITE-LEAK-20260822

**Status:** First-party sanitized demo incident drill; not a customer breach, independent benchmark, third-party dataset, certification, media evaluation, or endorsement
**Page:** https://infinisynapse.com/en/blog/api-key-for-data-agent
**Run ID:** `AK-VITE-LEAK-20260822`
**Date:** 2026-08-22
**Operator:** InfiniSynapse Data Team
**Attestor:** William Zhu, InfiniSynapse cofounder ([GitHub @allwefantasy](https://github.com/allwefantasy))
**Contact for contradictions:** zhuhl@infinisynapse.com

## What this file is

A downloadable record of a placeholder matching the `VITE_INFINI_KEY` pattern on a sanitized demo branch, a same-hour console revoke, and a replacement in a gitignored environment. No secret value is included. Companions: [aggregate CSV](https://infinisynapse.com/blog-media/api-key-for-data-agent/downloads/aggregate-AK-VITE-LEAK-20260822.csv) and [verify script](https://infinisynapse.com/blog-media/api-key-for-data-agent/downloads/verify-AK-VITE-LEAK-20260822.py). The CSV contains only two drill observations.

## Six-step method

1. Open API Key Management and review issue/revoke controls.
2. Issue a named, minimally scoped demo credential.
3. Store it in an appropriate secret mechanism; verify a demo env file is gitignored.
4. Configure the first-party interface without echoing the value.
5. Run a task smoke test and inspect allowed actions.
6. Revoke after exposure, issue a scoped replacement, search bundle and git history, then rerun the smoke test.

## Source and goal

| Field | Value |
|---|---|
| Source | Sanitized demo branch the desk is authorized to inspect |
| Goal asked twice | “Can this landing page start a task?” |
| Leak class | `VITE_INFINI_KEY` inlined into the shipped JavaScript bundle |
| Framework/build version | Not recorded |
| Demo commit hash | Not published |
| Secret-pattern placeholder | `VITE_INFINI_KEY`; value never published |
| Bundle search method/result | Text search found one placeholder pattern before replacement; exact command not recorded |
| Issue/revoke timestamps | Same-hour sequence; exact timestamps not recorded |
| Replacement scope/permissions | Restricted demo replacement; detailed scope not published |
| Git history scan | Performed; complete output not recorded |
| Task smoke test | Not run before replacement; passed after replacement |
| All outputs/failures | Not fully preserved |

## Results

| Retrieval state | Key in JS bundle | Revoked same hour | Gitignored env |
|---|---|---|---|
| `VITE_INFINI_KEY` shipped | 1 | 0 | 0 |
| Console-issued key | 0 | 1 | 1 |

Wall-clock from first grep to CLI restart: 18 minutes (warehouse time excluded). No warehouse password was in the bundle—only the agent key.

No independent reproduction was known as of 2026-08-28. A fuller replication must preserve framework/build version, demo commit hash, placeholder pattern without secret value, bundle-search method/results, issue/revoke timestamps, replacement scope, git-history scan, task smoke test, all outputs/failures, wall clock, and conflicts of interest.

## What you may cite

- Leak class, bundle flag 1→0, same-hour revoke, gitignored env 0→1, ~18 min wall-clock, run ID

## What you may not claim

- Customer breach, independent benchmark, third-party dataset, vendor test, certification, media evaluation, endorsement, or source/raw data

## External context (not validation of this drill)

- [Vite environment variables](https://vite.dev/guide/env-and-mode) (retrieved 2026-08-28)
- [Next.js environment variables](https://nextjs.org/docs/app/guides/environment-variables) (retrieved 2026-08-28)
- [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) (retrieved 2026-08-28)
- [OWASP API Security](https://owasp.org/API-Security/) (retrieved 2026-08-28)
- [GitHub secret scanning](https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning) (retrieved 2026-08-28)
- [MITRE CWE-798](https://cwe.mitre.org/data/definitions/798.html) (retrieved 2026-08-28)
- [NIST SSDF SP 800-218](https://csrc.nist.gov/pubs/sp/800/218/final) (retrieved 2026-08-28)