2026-10-30 · America/Los_Angeles · 社区动态 · #10

Where do you keep upstream API keys for an LLM gateway?

the litellm 1.107.0 stealer didnt stop at env vars, going by the writeups it also queried the proxys own postgres for saved provider credentials. those are encrypted at rest with the salt key but that key usually sits in the same process env so anything running inside the proxy gets both which makes me wonder if a gateway should hold long lived upstream keys at all for keys that have to exist it seems to come down to a scoped key per team with a spend cap, or short lived keys per workload from vault, hush security or a broker you run yourself. defining models in config with os.environ…

热度 45.2 / 100；排名与评分保留该期记录。