Repository navigation
fix(cli): pay no longer accepts the secret key as a CLI argument - #108
Merged
Merged
Conversation
`nirium pay ... --secret S...` put a real signing key in the shell history file and in `ps`'s full command line, readable by anyone else on the machine — true for any process, argv is not private. Removed the `-s, --secret` option entirely. The key now resolves from NIRIUM_SECRET_KEY, the config store (`nirium config set secretKey S...`), both already-existing paths that never touch argv, or a new interactive prompt when neither is set and stdin is a real terminal: readline with its echo suppressed, so nothing typed reaches the screen or any log capturing it. `--json` mode (meant for scripts, not a human at a keyboard) never prompts — it fails with the same clear error instead. Updated the two other places that told people to use the removed flag: `serve`'s own "test this server" hint, and the README's usage example and options table. No automated test added — packages/cli has no test runner wired up yet (#103). Verified by hand: --secret is gone from --help, NIRIUM_SECRET_KEY resolves without prompting, and --json with no key set fails clean (exit 1, no hang) instead of trying to read a terminal that isn't there. Closes #104 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This was referenced Oct 11, 2026
Eras256
added a commit
that referenced
this pull request
Oct 11, 2026
`nirium config set secretKey <key>`, `config set facilitatorApiKey <key>` and `serve --api-key <key>` all put a credential in shell history and in `ps`. They now exit 1, save or use nothing, and say why. The values come from the environment (NIRIUM_SECRET_KEY / FACILITATOR_API_KEY), a hidden prompt on a terminal, or stdin when there is none. Same reasoning as #108. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #104.
The leak
nirium pay <url> --secret S...put a real Stellar signing key where twothings could read it that have nothing to do with the user running the
command: the shell's history file, and
ps's full command line view —argvis visible to any other process/user on the same machine bydesign, not a Nirium-specific gap.
The fix
Removed
-s, --secret <secret>from thepaycommand entirely. The keynow resolves, in order:
NIRIUM_SECRET_KEYenvironment variable (already existed, nevertouches argv).
nirium config set secretKey S...(already existed, same reason).stdin is a real terminal — readline with its own echo suppressed, so
the key is never printed, not even as asterisks (which would still
leak its length).
--jsonmode is for scripts, not a human typing at a keyboard, so itnever prompts — missing key there fails immediately with the same clear
error it always gave, just without mentioning a flag that no longer
exists.
Also updated the two other spots that told people to use
--secret:serve's own "test this server" hint, and the README's usage example +options table.
Verified by hand (no test harness exists yet — #103)
nirium pay --helpno longer lists--secret.NIRIUM_SECRET_KEY=S... nirium pay <url> --jsonresolves the key andproceeds (reaches the network call) without prompting.
nirium pay <url> --jsonwith nothing set fails clean, exit 1, nohang — doesn't try to read a terminal that isn't there.
🤖 Generated with Claude Code