Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix Security: HERMES_REDACT_SECRETS off-by-default exposes API keys in user-visible Telegram/Discord chat output [2 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
NousResearch/hermes-agent#17691•Fetched 2026-04-30 06:46:03
View on GitHub
Comments
2
Participants
2
Timeline
6
Reactions
0
Author
frogwrapsfrogwraps
Participants
alt-glitchalt-glitchfrogwrapsfrogwraps
Timeline (top)
labeled ×4commented ×2

In a vanilla Hermes deployment, \ is OFF by default. As a result, when an end user converses with the agent through the gateway (Telegram, Discord), Hermes routinely echoes back live API key values as part of its visible chat responses (and writes them verbatim into ). For non-technical users this is invisible until something is breached.

Root Cause

In a vanilla Hermes deployment, \ is OFF by default. As a result, when an end user converses with the agent through the gateway (Telegram, Discord), Hermes routinely echoes back live API key values as part of its visible chat responses (and writes them verbatim into ). For non-technical users this is invisible until something is breached.

Fix Action

Fix / Workaround

Workaround (for users hitting this now)

RAW_BUFFERClick to expand / collapse

Summary

In a vanilla Hermes deployment, \ is OFF by default. As a result, when an end user converses with the agent through the gateway (Telegram, Discord), Hermes routinely echoes back live API key values as part of its visible chat responses (and writes them verbatim into ). For non-technical users this is invisible until something is breached.

Reproduction (real-world deployment)

Production Hermes Agent v0.11.0 on a Hostinger KVM2 VPS (Ubuntu 24.04), \ not set in .

Scanning conversation history for the exact values of credentials present in \ (read each \ from .env, grep -F for the value across session files):

  • 24 distinct env-defined credentials were found leaked
  • 345 files in \ and \ contained at least one credential value
  • Top hit-counts for genuinely sensitive keys:
    • OPENROUTER_API_KEY: 412 occurrences
    • GHL_AUTH_TOKEN: 80
    • BRAVE_API_KEY: 68
    • DATAFORSEO_PASSWORD: 66
    • VAPI_AUTH_TOKEN: 50
    • AI_GATEWAY_API_KEY: 24
    • GITHUB_PAT_HERMES: 20
    • HOSTINGER_API_TOKEN: 19
    • N8N_API_KEY: 17
    • PAPERCLIP_API_KEY: 2

The session JSONs are debug dumps (related to #8518) but the same content is also visible in the user-facing chat — meaning end users read their own keys back to themselves over Telegram/Discord, and the keys persist in any cloud chat backups (Telegram cloud, Discord servers).

Impact

  • User-visible leak vector: end users who never look at JSON dumps still see keys in their chat history.
  • Cloud transit: Telegram/Discord servers now hold copies of these keys.
  • No warning at gateway startup that redaction is off; user doesn't know to opt in until they audit.

Existing partial coverage

The redaction infrastructure is already excellent — \ has thoughtful patterns for OpenAI keys, GitHub PATs, Slack tokens, AWS keys, JWTs, Telegram bot tokens, DB connection strings, etc. \ already imports . The only thing missing is making it on by default.

Suggested fix (priority order)

  1. Change default to ON. \ (default 'true' instead of '').
  2. Loud opt-out warning. If user explicitly sets , gateway logs a prominent warning at startup ().
  3. Startup audit. On gateway start, scan \ mtime <30 days for cred prefix patterns; if hits found and redaction is OFF, log a one-time warning recommending opt-out users review.
  4. Documentation. README quickstart should explicitly call out the env var (currently it's only in code comments).

Related

  • #8518 — API key exposed in request debug dumps via incomplete masking
  • #16413 — Redaction system fails on lowercase/dotted config keys
  • #15934 — Regex false positives on source code files
  • #410 — Feature: Secure secrets management

Workaround (for users hitting this now)


Filed via gh CLI from a real affected user's VPS after a 24-cred / 345-file remediation.

extent analysis

TL;DR

Enable secret redaction by default by setting HERMES_REDACT_SECRETS to true in the .env file to prevent API key leaks in chat responses and session files.

Guidance

  • To fix the issue, update the _REDACT_ENABLED variable in the code to default to true instead of an empty string, as suggested in the issue.
  • Users can immediately mitigate the issue by setting HERMES_REDACT_SECRETS=true in their .env file and restarting the Hermes gateway.
  • After enabling redaction, audit and clean up historical session files in ~/.hermes/sessions/ to remove any leaked credentials.
  • Consider adding a loud opt-out warning at gateway startup if the user explicitly sets HERMES_REDACT_SECRETS=false.

Example

The provided workaround can be used to immediately enable secret redaction:

echo 'HERMES_REDACT_SECRETS=true' >> ~/.hermes/.env
systemctl restart hermes-gateway

Notes

The suggested fix only addresses the default behavior of the HERMES_REDACT_SECRETS variable and does not modify the existing redaction infrastructure. Users should still be cautious when handling sensitive credentials and regularly audit their session files.

Recommendation

Apply the workaround by setting HERMES_REDACT_SECRETS=true in the .env file to immediately enable secret redaction and prevent further credential leaks. This is a simple and effective solution to mitigate the issue until a more permanent fix is implemented.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#conversation history#container setup#orchestration issue#cache issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - 💡(How to fix) Fix Security: HERMES_REDACT_SECRETS off-by-default exposes API keys in user-visible Telegram/Discord chat output [2 comments, 2 participants]