Description
In backend/app/core/cache.py (compute_semantic_node_hash), API keys are stripped from hash computation using:
if not k.lower().endswith("key")
Impact
Legitimate non-secret node parameters such as chroma_key, animation_key, or frame_key are inadvertently excluded from node hash calculation, causing false cache hits across differing parameter values.
Affected Files
backend/app/core/cache.py
Proposed Remediation
Use an explicit denylist (e.g. {"api_key", "token", "secret"}) or declare secret types in parameter metadata.
Description
In
backend/app/core/cache.py(compute_semantic_node_hash), API keys are stripped from hash computation using:if not k.lower().endswith("key")Impact
Legitimate non-secret node parameters such as
chroma_key,animation_key, orframe_keyare inadvertently excluded from node hash calculation, causing false cache hits across differing parameter values.Affected Files
backend/app/core/cache.pyProposed Remediation
Use an explicit denylist (e.g.
{"api_key", "token", "secret"}) or declare secret types in parameter metadata.