This repo expects two GitHub Actions secrets:
| Secret | Used for |
|---|---|
OPENAI_API_KEY |
OpenAI API calls in the generator script |
ICON_INGEST_KEY |
X-Api-Key header when POSTing icons to FreeVectorIcons |
Never commit secret values. Do not log environment variables in workflow output.
If you fork this repo, configure your own secrets. Fork workflows do not receive secrets from the upstream organization.
ICON_INGEST_KEY grants write access to the FreeVectorIcons icon ingest API (POST /api/icons/ingest). Treat it like a production credential:
- Store only in GitHub Actions secrets and server-side env
- Rotate if you suspect exposure
- Do not share in issues, PRs, or chat logs
The ingest URL and header name are public in this repository. Security relies on the key staying secret and unguessable.
The Generate Icons workflow is manual (workflow_dispatch) and uses organization secrets when run on FreeVectorIcons/ai-icon-generator.
Only collaborators with write access can trigger it. Each run spends OpenAI credit and may insert icons into the production catalog.
Email hemanta@freevectoricons.com with:
- What you found
- Steps to reproduce
- Impact (e.g. unauthorized ingest, secret exposure)
Please do not open public issues for undisclosed security problems.
We aim to respond within a few business days.
Safe to be public (by design): generation prompts, ingest URL, env var names, /api/stats reads.
Keep private: API keys, ingest keys, OpenAI keys, internal run-cost tracking.