Skip to content

🔒 Enforce HTTPS for OpenAI API requests - #28

Merged
sneakocom merged 1 commit into
mainfrom
fix-subject-adapter-https-enforcement-15064313750557907547
Sep 18, 2026
Merged

sneakocom merged 1 commit into
mainfrom
fix-subject-adapter-https-enforcement-15064313750557907547

Conversation

@sneakocom

Copy link
Copy Markdown
Contributor

🎯 What: Added strict validation to ensure call_openai only allows https:// endpoints.
⚠️ Risk: Without this check, sensitive credentials like api_key could potentially be transmitted over unencrypted HTTP, allowing interception by network attackers.
🛡️ Solution: The call_openai function now explicitly raises a ValueError if the provided endpoint does not begin with https://. In addition, cascading identity hashes for subject_adapter.py were updated in preregistration.json, contract.json, verification-report.json, and experiments.json to reflect the new code signature and preserve test correctness.


PR created automatically by Jules for task 15064313750557907547 started by @sneakocom

🎯 **What:** Added strict validation to ensure `call_openai` only allows `https://` endpoints.
⚠️ **Risk:** Without this check, sensitive credentials like `api_key` could potentially be transmitted over unencrypted HTTP, allowing interception by network attackers.
🛡️ **Solution:** The `call_openai` function now explicitly raises a `ValueError` if the provided endpoint does not begin with `https://`. In addition, cascading identity hashes for `subject_adapter.py` were updated in `preregistration.json`, `contract.json`, `verification-report.json`, and `experiments.json` to reflect the new code signature and preserve test correctness.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
@google-labs-jules

Copy link
Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@sneakocom
sneakocom merged commit 0cbfb59 into main Sep 18, 2026
1 check passed
@sneakocom
sneakocom deleted the fix-subject-adapter-https-enforcement-15064313750557907547 branch September 18, 2026 01:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant