mirror of
https://github.com/crewAIInc/crewAI.git
synced 2026-08-10 08:21:54 +00:00
SHA-256 of API key material in _cache_key trips py/weak-sensitive-data-hashing (CodeQL alert #64). Use HMAC-SHA256 with the credential as the key and a fixed app message so the cache partition id stays non-reversible without password-style hashing. Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>