-
Notifications
You must be signed in to change notification settings - Fork 1
dev: Remove old README, update docs #2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| # Gemini API Key for local development/testing | ||
| # Note: For the GitHub Pages site, users will be prompted to enter their own API key | ||
| # which is stored in their browser's localStorage (not shared with the server) | ||
| # Get your free API key at: https://aistudio.google.com/apikey | ||
| GEMINI_API_KEY=AIzaSyB1kLWIDXGvwikSQyAbqhytf3wHf65aulQ | ||
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,120 @@ | ||||||||
| /** | ||||||||
| * TinyGPU Gemini API Proxy - Cloudflare Worker | ||||||||
| * | ||||||||
| * This worker proxies requests to the Gemini API, keeping your API key secure. | ||||||||
| * Deploy this to Cloudflare Workers and set the GEMINI_API_KEY secret. | ||||||||
| * | ||||||||
| * Setup Instructions: | ||||||||
| * 1. Go to https://dash.cloudflare.com/ and sign up/login | ||||||||
| * 2. Go to Workers & Pages > Create Application > Create Worker | ||||||||
| * 3. Name it something like "tinygpu-gemini-proxy" | ||||||||
| * 4. Replace the default code with this file's contents | ||||||||
| * 5. Go to Settings > Variables > Add Variable | ||||||||
| * - Name: GEMINI_API_KEY | ||||||||
| * - Value: Your Gemini API key | ||||||||
| * - Click "Encrypt" to keep it secret | ||||||||
| * 6. Save and Deploy | ||||||||
| * 7. Your worker URL will be: https://tinygpu-gemini-proxy.<your-subdomain>.workers.dev | ||||||||
| */ | ||||||||
|
|
||||||||
| export default { | ||||||||
| async fetch(request, env) { | ||||||||
| // Handle CORS preflight | ||||||||
| if (request.method === "OPTIONS") { | ||||||||
| return new Response(null, { | ||||||||
| headers: { | ||||||||
| "Access-Control-Allow-Origin": "*", | ||||||||
|
||||||||
| "Access-Control-Allow-Methods": "POST, OPTIONS", | ||||||||
| "Access-Control-Allow-Headers": "Content-Type", | ||||||||
| "Access-Control-Max-Age": "86400", | ||||||||
| }, | ||||||||
| }); | ||||||||
| } | ||||||||
|
|
||||||||
| // Only allow POST requests | ||||||||
| if (request.method !== "POST") { | ||||||||
| return new Response(JSON.stringify({ error: "Method not allowed" }), { | ||||||||
| status: 405, | ||||||||
| headers: { | ||||||||
| "Content-Type": "application/json", | ||||||||
| "Access-Control-Allow-Origin": "*", | ||||||||
|
||||||||
| }, | ||||||||
| }); | ||||||||
| } | ||||||||
|
|
||||||||
| try { | ||||||||
| // Get the request body | ||||||||
| const body = await request.json(); | ||||||||
|
|
||||||||
| // Validate required fields | ||||||||
| if (!body.prompt) { | ||||||||
| return new Response(JSON.stringify({ error: "Missing prompt" }), { | ||||||||
| status: 400, | ||||||||
| headers: { | ||||||||
| "Content-Type": "application/json", | ||||||||
| "Access-Control-Allow-Origin": "*", | ||||||||
| }, | ||||||||
| }); | ||||||||
| } | ||||||||
|
Comment on lines
+49
to
+58
|
||||||||
|
|
||||||||
| // Build Gemini API request | ||||||||
| const geminiUrl = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${env.GEMINI_API_KEY}`; | ||||||||
|
||||||||
| const geminiUrl = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${env.GEMINI_API_KEY}`; | |
| const GEMINI_MODEL = env.GEMINI_MODEL || 'gemini-2.0-flash'; | |
| const geminiUrl = `https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_MODEL}:generateContent?key=${env.GEMINI_API_KEY}`; |
Copilot
AI
Dec 16, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The error response from the Gemini API is being returned verbatim to the client, which could potentially leak sensitive information about the API configuration, internal error details, or rate limits.
Consider sanitizing the error response before sending it to the client:
- Don't expose the full error text from the API
- Map API status codes to user-friendly messages
- Log detailed errors server-side for debugging, but return generic messages to clients
Example:
console.error('Gemini API error:', errorText); // Log for debugging
return new Response(JSON.stringify({
error: 'Unable to process request',
code: geminiResponse.status
}), {...});
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This file contains an exposed Gemini API key that is now committed to the repository. API keys should never be committed to version control as they can be used by anyone who has access to the repository or its history.
This API key should be:
The comment on lines 2-3 is misleading - it states that users will enter their own API key in localStorage for GitHub Pages, but this file contains an actual API key that will be in the git history even if removed.