ZeroClaw
A ZeroClaw Gemini transport error can post the API key back into the originating chat
A ZeroClaw report traces Gemini’s key from a key-bearing request URL into reqwest error text, through a sanitizer that recognizes seven other token prefixes, and into the originating chat. A network failure is enough; the chat may be a group.
zeroclaw-labs/zeroclaw issue #9386 is the inspected primary source: “[Bug]: a Gemini API key in the request URL survives sanitize_api_error and is posted into the originating chat.” Issue #9386 identifies the full path. The Gemini provider formats the credential into the request query string. A transport error’s Display value includes the complete URL. sanitize_api_error delegates to a prefix list containing sk-, Slack tokens, and GitHub token forms but not the Google AIza prefix, so the query survives. The channel orchestrator then formats the sanitized string as a user-facing Error and sends it to the original reply target. ZeroClaw’s separate LeakDetector knows the AIza pattern, but channel.send is not behind that detector. The reporter reproduced the behavior against a closed local port and included a positive control proving the same sanitizer removes an OpenAI-shaped token. DNS failure, blocked egress, a captive portal, or a dropped connection can trigger the path without an attacker.
The facts
- zeroclaw-labs/zeroclaw issue #9386 was created 2026-07-26T13:28:03Z and updated 2026-07-27T00:58:19Z; state is open. - zeroclaw-labs/zeroclaw returned 32401 GitHub stars, 596 open issues, default branch master, and last push 2026-07-26T22:09:26Z. - Latest tagged-release baseline checked: v0.8.3 published 2026-07-16T01:47:13Z. - Issue #9386 identifies the full path. - The Gemini provider formats the credential into the request query string. - A transport error’s Display value includes the complete URL. - sanitize_api_error delegates to a prefix list containing sk-, Slack tokens, and GitHub token forms but not the Google AIza prefix, so the query survives. - The channel orchestrator then formats the sanitized string as a user-facing Error and sends it to the original reply target.
What changed
Issue #9386 identifies the full path. The Gemini provider formats the credential into the request query string. A transport error’s Display value includes the complete URL. sanitize_api_error delegates to a prefix list containing sk-, Slack tokens, and GitHub token forms but not the Google AIza prefix, so the query survives. The channel orchestrator then formats the sanitized string as a user-facing Error and sends it to the original reply target. ZeroClaw’s separate LeakDetector knows the AIza pattern, but channel.send is not behind that detector. The reporter reproduced the behavior against a closed local port and included a positive control proving the same sanitizer removes an OpenAI-shaped token. DNS failure, blocked egress, a captive portal, or a dropped connection can trigger the path without an attacker. The primary record was inspected with its timestamps, state, body, and adjacent project records. ClawCharts supplied the assignment list; it does not establish the claim.
Why it matters
This is a boundary failure, not merely an incomplete regex. Credentials should not enter URLs that are routinely copied into logs and error objects, and user-visible errors should not depend on an enumerated list of every vendor’s current prefix. Group-chat delivery turns a transient network fault into credential disclosure and persistence. The operational test is whether persisted state, visible control, and runtime behavior agree at the handoff where authority changes.
Current
The issue was open against current source. ZeroClaw’s latest stable tag remained v0.8.3 while a v0.8.4 release candidate was active. PR #9410 separately admits command audit logging was configured as enabled without a production writer, and PR #9416 aligns the model-visible tool catalog with allowlists. Those records reinforce security-honesty work but do not close this Gemini path. Repository metadata, current issues and pull requests, release baseline, Hacker News discovery, and the rendered ranking row were checked. Weak search residue and historically used source spines were not promoted.
Evidence
The primary URL is https://github.com/zeroclaw-labs/zeroclaw/issues/9386. Supporting links are inspected current project records that establish implementation, adjacent direction, or boundary conditions. Dates, reproductions, test totals, and deployment observations remain attributed to their authors unless this brief explicitly says they were independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. Closure can reflect a documentation decision or triage outcome; it is not silently translated into a shipped code fix. Ranking explains why the project was scanned; it does not prove correctness, adoption, or package behavior.
Operator take
Rotate any exposed key through the provider, not by editing logs. For prevention, move credentials to headers, strip query strings before formatting transport errors, and keep a structural secret scrub at every public error boundary. Preserve a before-state receipt and verify the narrowest invariant where state changes. Do not broaden permissions or delete state merely because the visible symptom is inconvenient.
Caveat
Public project records are mutable. Source state was captured at publication time, and later revisions may change status, scope, or evidence. No source here authorizes automatic mutation of a reader’s deployment.
Source inspected; source state, environment, and release boundary remain explicit.