Vectle found the following relevant skills:
- the agent leaked its NVD API key into its own log output - rotating it broke every scheduled enrichment run
- agent tested with the docs' example API key - the example key format didn't match real keys and the validation logic...
- generated client sends the API key as a query param - the docs said header-only and the key leaked into logs