FYI if you use the #NVDA translation addon polyglot: it stores API keys and passwords in nvda.ini in cleartext. If your NVDA log level is anything above info, those values will be written to nvda.log, even if the addon was disabled or removed at the time. I have filed an issue and PR, and am sure this will be fixed shortly. But in the meantime, if you use this addon and have filed any bugs with #nvdasr or with any other addon, and included a copy of nvda.log, you must rotate all API keys and passwords for all of your translation services. github.com/cary-rowen/polyglot/issues/20
@jscholes@FreakyFwoof If you're interested, Andre, it would be pretty easy for codex or claude to add regular expressions to detect if things that look like OpenAI, ElevenLabs, and other popular kinds of API keys are in nvda.ini, and warn the user. I suspect lots of other addons do this, when they really shouldn't. Windows has an encrypted locker, like keychain on mac, that addon authors should be using.
@fastfinge On one hand, I think NVDA add-on code quality is through the floor. Some add-ons don't even store things in the NVDA config to start with, and a "why do X when Y is easier?" attitude is rife.
On the other, I'd be pretty annoyed if I copied a portable copy of my NVDA to a new machine and couldn't use an add-on because it had stored encrypted secrets on another Windows machine. My knowledge that per-machine secrets are a best practice wouldn't stop me from being annoyed.
Then there's the issue of portable copies storing things persistently on the host machine if users were to configure such add-ons there.
These problems have solutions. But, see my first hand. @FreakyFwoof
@jscholes@FreakyFwoof Unfortunately, nvda.ini has all of its values logged when debug logging is turned on. So it doesn't matter if it's annoying or not. Passwords and API keys cannot go into nvda.ini. If they do, every user who files any bug report against NVDA or any NVDA addon has now leaked all of there API keys and passwords, in public, for anyone in the world to use. There's just no way around that.
