“Bring your own key” looks like a settings feature. For an AI coding agent, it is also a security boundary: a privileged workload will send repository context, prompts, and credentials toward a network destination selected by configuration.
That boundary deserves more than a successful GET /models request.
I reviewed MonkeyCode, an open-source AI development platform, at commit c58bcd4. Its source provides a useful concrete case because users can configure model providers while task runtimes receive proxy credentials.
This is a source review, not a penetration test. In particular, I am not claiming encryption, rotation, or revocation behavior that the reviewed files do not establish.
Map the two credential planes
