[Security] Exposed Google OAuth client secrets in fixed_providers.py

[Ahlyx]

Two Google OAuth client secrets are hardcoded and publicly visible in your repository:

File: src/core/provider_templates/fixed_providers.py

• ProviderType.GEMINI_CLI — client_secret: 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
• ProviderType.ANTIGRAVITY — client_secret: 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

These are Google OAuth client secrets (GOCSPX- prefix). The file comment acknowledges these were copied from CLIProxyAPI and are sensitive. Anyone with access to this repository can use these to impersonate the OAuth clients and potentially intercept authorization flows.

Recommended actions:

1. Remove both client_secret values from the file immediately
2. Report the exposed secrets to Google at https://bughunters.google.com so they can rotate them — since these appear to be Google's own internal CLI credentials, Google is the party that needs to act
3. Load client secrets from environment variables rather than hardcoding them
4. If these values exist in git history, use git-filter-repo to purge them

Reporting in good faith. I have not used these credentials.

[fawney19]

感谢你的报告。

这两个 client_secret 值来自 Google 官方 CLI 工具（Gemini CLI / gcloud）的内置 OAuth 客户端凭据，并非本项目私有密钥。它们已在多个开源项目中公开使用（如 CLIProxyAPI 等），属于 Google 自己管理的客户端标识符。

这类凭据的作用类似于 client_id，其本身不构成独立的安全边界——OAuth 流程的安全性由用户的授权行为和 token 生命周期保证，而非 client_secret 的保密性。

因此我们决定保持现状，不做更改。如果 Google 认为这些凭据需要轮换，他们可以直接处理。