Openai key leakages

[alex4321]

Description:

By default - ChatOpenAI implementation and OpenAIEmbeddings implementations do not hide openai_api_key from repr implementation.

Which may lead to key leakages. Like I were working on some project with Jupyter Notebook, I am used to show intermediate stages - and I am far from being cautious. So I made something like:

key = _read_key_from_some_gitignored_env_file()
input = ChatPromptTemplate.from_messages([SystemMessagePromptTemplate.from_template("Foobar")])
chat = ChatOpenAI(openai_api_key=key)
chain = input | chat
chain

or, for instance (you can run this code in python interactive session):

from langchain.chat_models import ChatOpenAI
ChatOpenAI(openai_api_key="sk-TEST")

you can see this output

ChatOpenAI(client=<class 'openai.api_resources.chat_completion.ChatCompletion'>, openai_api_key='sk-TEST', openai_api_base='', openai_organization='', openai_proxy='')

And since I were used to show intermediate stages I have shown what chain is without noticing it contains key.

Fortunately, OpenAI monitor key leakages on their side, but they can only do it on public resources, like public github repositorys.

This PR:

• add tests regards this matter
• fix OpenAIEmbeddings::__repr_args__ and ChatOpenAI::__repr_args__ in such a way so repr(someobject) do not contains openai_api_key anymore:

from langchain.chat_models import ChatOpenAI
ChatOpenAI(openai_api_key="sk-TEST")

ChatOpenAI(client=<class 'openai.api_resources.chat_completion.ChatCompletion'>, openai_api_base='', openai_organization='', openai_proxy='')

No openai_api_key="sk-TEST" anymore

• Dependencies:

No additional dependencies

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Comments	Updated (UTC)
langchain	⬜️ Ignored (Inspect)	Visit Preview		Oct 28, 2023 4:34am

[eyurtsev]

hi @alex4321 thanks for the contribution. Could you take a look at this issue and follow the guidelines there for making the change: #12165

[eyurtsev]

Hi @alex4321 👋 -- take a look here: #12473