Skip to content

feat: add shunya transcriber#436

Open
RG-04 wants to merge 6 commits intomasterfrom
feat/shunya-transcriber
Open

feat: add shunya transcriber#436
RG-04 wants to merge 6 commits intomasterfrom
feat/shunya-transcriber

Conversation

@RG-04
Copy link
Copy Markdown
Contributor

@RG-04 RG-04 commented Jan 7, 2026

No description provided.

@RG-04 RG-04 requested a review from san0808 January 7, 2026 14:15
@RG-04 RG-04 force-pushed the feat/shunya-transcriber branch 2 times, most recently from d15d687 to ba8355e Compare January 8, 2026 09:38
@RG-04 RG-04 force-pushed the feat/shunya-transcriber branch from ba8355e to 3fc67f4 Compare January 30, 2026 11:07
@RG-04 RG-04 force-pushed the feat/shunya-transcriber branch from 3fc67f4 to 075b6d3 Compare February 10, 2026 12:41
# Send initialization message
init_msg = self._create_init_message()
await ws.send(json.dumps(init_msg))
logger.info(f"Sent initialization message to Shunya Labs, {json.dumps(init_msg)}")

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (password)
as clear text.

Copilot Autofix

AI 2 months ago

To fix the problem, the code should stop logging the full init_msg including the api_key. Instead, log only non-sensitive parts of the initialization message, or simply confirm that the message was sent without including its content. This preserves observability (knowing that an init message was sent) while eliminating exposure of the API key.

The best minimal fix without changing existing functionality is:

  • Keep _create_init_message unchanged so the WebSocket still receives the full configuration, including api_key.
  • Change the log statement on line 265 so it no longer includes json.dumps(init_msg). Optionally, log a filtered view of init_msg with the api_key omitted or masked.

Concretely:

  • In bolna/transcriber/shunya_transcriber.py, locate the block where init_msg is created and sent:
    • Line 263: init_msg = self._create_init_message()
    • Line 264: await ws.send(json.dumps(init_msg))
    • Line 265: logger.info(f"Sent initialization message to Shunya Labs, {json.dumps(init_msg)}")
  • Replace line 265 with a safe logging statement that either:
    • logs just a static message (most conservative), or
    • logs a redacted/partial version of the config (e.g., language, model, and api_key replaced with "***").

No new methods or imports are strictly required; we can construct a small redacted dict inline if desired. To stay simple and robust, I’ll log only non-sensitive configuration fields (language, model, frames_silence_duration) and omit the key entirely.

Suggested changeset 1
bolna/transcriber/shunya_transcriber.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/bolna/transcriber/shunya_transcriber.py b/bolna/transcriber/shunya_transcriber.py
--- a/bolna/transcriber/shunya_transcriber.py
+++ b/bolna/transcriber/shunya_transcriber.py
@@ -262,7 +262,7 @@
                 # Send initialization message
                 init_msg = self._create_init_message()
                 await ws.send(json.dumps(init_msg))
-                logger.info(f"Sent initialization message to Shunya Labs, {json.dumps(init_msg)}")
+                logger.info("Sent initialization message to Shunya Labs (sensitive fields omitted from logs)")
                 
                 self.session_initialized = True
                 self.connection_authenticated = True
EOF
@@ -262,7 +262,7 @@
# Send initialization message
init_msg = self._create_init_message()
await ws.send(json.dumps(init_msg))
logger.info(f"Sent initialization message to Shunya Labs, {json.dumps(init_msg)}")
logger.info("Sent initialization message to Shunya Labs (sensitive fields omitted from logs)")

self.session_initialized = True
self.connection_authenticated = True
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants