Security: Exposed credentials detected in this repository

[syllogismos]

Leaked Credentials Detected

Hi there! While reviewing public repositories submitted to the Gemini Live Agent Challenge, we ran an automated security scan and found exposed credentials in this repo.

This repository contains API keys committed in source code. Even if these keys are currently inactive, they may have been harvested by automated scanners. We recommend rotating them as a precaution.

What was found

File	Credential Type
helix_code/openclaw_agent.py	generic-api-key
helix_code/tests/test_secret_resolver.py	generic-api-key

Recommended actions

1. Revoke and rotate all exposed credentials immediately
   • For Google/GCP API keys: Google Cloud Console → APIs & Services → Credentials
   • For other services: check the respective provider's dashboard
2. Remove secrets from code — use environment variables or a secrets manager instead
3. Add .env to .gitignore to prevent future commits of secret files
4. Scrub git history — even after deleting the file, secrets remain in git history. Use git-filter-repo or BFG Repo-Cleaner to remove them
5. Consider using Google Secret Manager for production deployments

About this scan

This issue was created as part of a responsible disclosure effort after scanning public hackathon submissions. No credentials were used or exploited — only a read-only API endpoint was called to check if keys were active. The actual secret values are not included in this issue.

If you believe this is a false positive, feel free to close this issue.