fix: documentation contains hardcoded api key exampl... in api-guide.mdx

[orbisai0security]

Summary

Fix high severity security issue in docs/api-guide.mdx.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	docs/api-guide.mdx:67
Assessment	Likely exploitable

Description: Documentation contains hardcoded API key examples that could be mistakenly used in production code. The example shows 'CONTEXT7_API_KEY' as a placeholder, but developers might copy-paste this without replacing it with environment variables.

Evidence

Exploitation scenario: An attacker who can access the public documentation or source code repository can identify the API key pattern and search for similar hardcoded credentials in deployed applications.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• docs/api-guide.mdx

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

import fs from 'fs';
import path from 'path';

describe('Documentation must not contain hardcoded API key placeholders that could be mistaken for valid credentials', () => {
  const payloads = [
    { 
      name: 'exact_exploit_case', 
      content: 'CONTEXT7_API_KEY',
      description: 'exact hardcoded placeholder from vulnerable snippet'
    },
    { 
      name: 'boundary_case', 
      content: 'API_KEY',
      description: 'generic API key placeholder that could be mistaken'
    },
    { 
      name: 'valid_input', 
      content: 'process.env.API_KEY',
      description: 'environment variable reference pattern'
    }
  ];

  const docPath = path.join(__dirname, '../docs/api-guide.mdx');

  test.each(payloads)('documentation does not contain dangerous placeholder: $description', ({ content }) => {
    // Read the actual production documentation file
    const fileContent = fs.readFileSync(docPath, 'utf-8');
    
    // Security property: Documentation must not contain hardcoded API key placeholders
    // that could be copy-pasted into production code without replacement
    const dangerousPattern = new RegExp(`["']${content}["']`, 'g');
    const matches = fileContent.match(dangerousPattern);
    
    // What must always be true: No hardcoded API key placeholders should exist
    // in the documentation that could be mistaken for valid credentials
    expect(matches).toBeNull();
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security

[enesgules]

Thanks!