Julius BrusseeandClaude Fable 5 bceaa0cf6d fix(#528): benchmarks/run.py reads only ANTHROPIC_API_KEY from .env.local ...

The old loader setdefault'ed EVERY key found in repo-root .env.local
into os.environ. Security scanners (Hermes skill scan, issue #528) flag
that as a high-severity exfiltration surface: install caveman into a
profile with secrets in .env.local and the benchmark quietly pulls all
of them into its process environment.

The benchmark only ever needs ANTHROPIC_API_KEY (anthropic.Anthropic()
reads it implicitly), so read that one key and nothing else — skip the
file entirely when the var is already set.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011kmm2umRGb5nLxdimrwweZ

2026-07-02 15:14:12 +02:00

..

results

Add benchmarks suite and update README

2026-04-05 19:25:25 +02:00

prompts.json

Add benchmarks suite and update README

2026-04-05 19:25:25 +02:00

requirements.txt

Add benchmarks suite and update README

2026-04-05 19:25:25 +02:00

run.py

fix(#528): benchmarks/run.py reads only ANTHROPIC_API_KEY from .env.local

2026-07-02 15:14:12 +02:00