[Security Alert] Exposed API key(s) detected: AWS Access Key, HuggingFace Token

[hdhdn]

Hi,

An automated responsible-disclosure scan found pattern(s) matching the following API key type(s) in this file:

https://github.com/ContextLab/clustrix/blob/6df494a7e0a90381a2f823a6c3c0ef53c8728c6e/clustrix/credential_manager.py

Keys detected

• AWS Access Key → revoke at https://console.aws.amazon.com/iam
• HuggingFace Token → revoke at https://huggingface.co/settings/tokens

Recommended actions

1. Revoke each key immediately using the links above
2. Remove the key(s) from the file and commit the change
3. Purge from git history — keys remain accessible in old commits even after deletion. Use git filter-repo or BFG Repo Cleaner
4. Rotate any dependent services that used these credentials

This is an automated alert. No keys were tested, validated, or used in any way. If this is a false positive, please close this issue.

---

Sent by a responsible disclosure scanner to help protect accidentally exposed credentials.