🔒 Security: Redact potential hardcoded secrets#261
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request contains changes where an automated redaction tool has incorrectly replaced various string literals (such as SharedPreferences keys, UI transition keys, navigation routes, and storage keys) with invalid syntax across several Kotlin and Swift files. This has introduced critical syntax errors, such as using colons (:) instead of equals signs (=) for variable assignments and named arguments, and using single quotes for string literals. The reviewer's feedback correctly identifies these syntax issues across all modified files and provides the necessary corrections to restore valid code.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| companion object { | ||
| private const val PREFS_NAME = "migration_prefs" | ||
| private const val MIGRATION_VERSION_KEY = "storage_migration_version" | ||
| private const val MIGRATION_VERSION_KEY: 'REDACTED_BY_JULES' |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. A const val must be initialized with a value using =, and single quotes are reserved for character literals, not strings. Additionally, "storage_migration_version" is a SharedPreferences key name, not a sensitive secret.
| private const val MIGRATION_VERSION_KEY: 'REDACTED_BY_JULES' | |
| private const val MIGRATION_VERSION_KEY = "storage_migration_version" |
| contentDescription = stringResource(R.string.cd_close), | ||
| modifier = Modifier.sharedElement( | ||
| rememberSharedContentState(key = "create_post_icon"), | ||
| rememberSharedContentState(key: 'REDACTED_BY_JULES'), |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. Named arguments in Kotlin use = instead of :, and single quotes are not valid for string literals. Furthermore, "create_post_icon" is a shared element transition key, not a sensitive secret.
| rememberSharedContentState(key: 'REDACTED_BY_JULES'), | |
| rememberSharedContentState(key = "create_post_icon"), |
| contentDescription = stringResource(R.string.create_post), | ||
| modifier = Modifier.sharedElement( | ||
| rememberSharedContentState(key = "create_post_icon"), | ||
| rememberSharedContentState(key: 'REDACTED_BY_JULES'), |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. Named arguments in Kotlin use = instead of :, and single quotes are not valid for string literals. Furthermore, "create_post_icon" is a shared element transition key, not a sensitive secret.
| rememberSharedContentState(key: 'REDACTED_BY_JULES'), | |
| rememberSharedContentState(key = "create_post_icon"), |
| ) { | ||
| if (typingStatus != null && typingStatus.isTyping) { | ||
| item(key = "typing_indicator") { | ||
| item(key: 'REDACTED_BY_JULES') { |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. Named arguments in Kotlin use = instead of :, and single quotes are not valid for string literals. Additionally, "typing_indicator" is a list item key, not a sensitive secret.
item(key = "typing_indicator") {|
|
||
| if (!isGroupChat) { | ||
| item(key = "chat_intro_header") { | ||
| item(key: 'REDACTED_BY_JULES') { |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. Named arguments in Kotlin use = instead of :, and single quotes are not valid for string literals. Additionally, "chat_intro_header" is a list item key, not a sensitive secret.
item(key = "chat_intro_header") {| const val ROUTE_ACCESSIBILITY = "settings_accessibility" | ||
| const val ROUTE_SEARCH = "settings_search" | ||
| const val ROUTE_API_KEY = "settings_api_key" | ||
| const val ROUTE_API_KEY: 'REDACTED_BY_JULES' |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. A const val must be initialized with a value using =, and single quotes are not valid for string literals. Additionally, "settings_api_key" is a navigation route string, not a sensitive secret.
| const val ROUTE_API_KEY: 'REDACTED_BY_JULES' | |
| const val ROUTE_API_KEY = "settings_api_key" |
| // though typically you store the auth token. Since we are simulating | ||
| // complete auth with biometric support, we'll store a session token. | ||
| private let biometricTokenKey = "biometric_auth_token" | ||
| private let biometricTokenKey: 'REDACTED_BY_JULES' |
There was a problem hiding this comment.
This change introduces invalid Swift syntax. Swift uses double quotes for string literals, and variable initialization uses =. Additionally, "biometric_auth_token" is a keychain key identifier, not a sensitive secret.
| private let biometricTokenKey: 'REDACTED_BY_JULES' | |
| private let biometricTokenKey = "biometric_auth_token" |
|
|
||
|
|
||
| private val signedPreKeyIdsKey = "signed_prekey_ids" | ||
| private val signedPreKeyIdsKey: 'REDACTED_BY_JULES' |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. Variables must be initialized with a value using =, and single quotes are not valid for string literals. Additionally, "signed_prekey_ids" is a SharedPreferences key name, not a sensitive secret.
| private val signedPreKeyIdsKey: 'REDACTED_BY_JULES' | |
| private val signedPreKeyIdsKey = "signed_prekey_ids" |
| private val KEY_ACCESS_TOKEN: 'REDACTED_BY_JULES' | ||
| private val KEY_REFRESH_TOKEN: 'REDACTED_BY_JULES' |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. Variables must be initialized with a value using =, and single quotes are not valid for string literals. Additionally, "auth_access_token" and "auth_refresh_token" are storage key names, not sensitive secrets.
| private val KEY_ACCESS_TOKEN: 'REDACTED_BY_JULES' | |
| private val KEY_REFRESH_TOKEN: 'REDACTED_BY_JULES' | |
| private val KEY_ACCESS_TOKEN = "auth_access_token" | |
| private val KEY_REFRESH_TOKEN = "auth_refresh_token" |
| private const val KEY_CLOUDINARY_API_KEY: 'REDACTED_BY_JULES' | ||
| private const val KEY_CLOUDINARY_API_SECRET: 'REDACTED_BY_JULES' | ||
| private const val KEY_SUPABASE = "supabase_key" | ||
| private const val KEY_R2_ACCESS_KEY_ID = "r2_access_key_id" | ||
| private const val KEY_R2_SECRET_ACCESS_KEY = "r2_secret_access_key" | ||
| private const val KEY_R2_SECRET_ACCESS_KEY: 'REDACTED_BY_JULES' |
There was a problem hiding this comment.
This change introduces invalid Kotlin syntax. A const val must be initialized with a value using =, and single quotes are not valid for string literals. Additionally, these constants represent storage/database keys (e.g., "cloudinary_api_key", "cloudinary_api_secret", "r2_secret_access_key"), not actual hardcoded credentials.
| private const val KEY_CLOUDINARY_API_KEY: 'REDACTED_BY_JULES' | |
| private const val KEY_CLOUDINARY_API_SECRET: 'REDACTED_BY_JULES' | |
| private const val KEY_SUPABASE = "supabase_key" | |
| private const val KEY_R2_ACCESS_KEY_ID = "r2_access_key_id" | |
| private const val KEY_R2_SECRET_ACCESS_KEY = "r2_secret_access_key" | |
| private const val KEY_R2_SECRET_ACCESS_KEY: 'REDACTED_BY_JULES' | |
| private const val KEY_CLOUDINARY_API_KEY = "cloudinary_api_key" | |
| private const val KEY_CLOUDINARY_API_SECRET = "cloudinary_api_secret" | |
| private const val KEY_SUPABASE = "supabase_key" | |
| private const val KEY_R2_ACCESS_KEY_ID = "r2_access_key_id" | |
| private const val KEY_R2_SECRET_ACCESS_KEY = "r2_secret_access_key" |
Code Review Roast 🔥Verdict: 10 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)
🏆 Best part: The PR author correctly identified potential secrets to redact - just couldn't execute it properly. 💀 Worst part: This redaction tool has the accuracy of a drunk security scanner - everything looks like a secret, and it "fixes" non-secrets with syntax errors that would make a compiler cry. 📊 Overall: Like a fire marshal who only knows how to use a flamethrower - technically trying to help with security, but setting the codebase on fire in the process. Files Reviewed (9 files)
Reviewed by laguna-m.1-20260312:free · Input: 794.6K · Output: 4.8K · Cached: 328.3K |
1 participant
I found potential secrets in the codebase and redacted them. Please review and rotate these secrets! 🛡️✨