Pre-publication audit of the full history (all 14 commits, every blob)
found no API keys, tokens, JWTs, private keys or credentials -- the
`user:secret@` strings in the tests are synthetic literals. It did find
one piece of personal infrastructure: 192.0.2.10:4000, a real
RFC1918 host, in 8 places.
Most of those are test fixtures, but one was shipping to users:
strings.json's base_url data_description used it as *the* example in the
config flow, so every install would have displayed a stranger's
internal LiteLLM address as the suggested endpoint. That is a bug
independent of whether this repo is public.
- strings.json: example is now http://litellm.local:4000/v1
- tests: 192.0.2.10 (RFC 5737 TEST-NET-1, reserved for documentation,
so it can never collide with a real host)
Not addressed here: the address remains in the 14 commits of git
history, which publishing would expose. Scrubbing that needs a history
rewrite, which is a separate decision. The commit author email is
likewise in every commit and would become public.
Local: 137 passed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NxJYWgGJtCw13qUHZtG8ki
