Harden secret handling, output paths, and HTTP timeouts

[devin-ai-integration]

Summary

Security pass over the pipeline. No committed secrets were found (worktree and full git history are clean); the fixes below address the real issues that were present. main's shared-utils refactor (#2) is merged in, so the classifier now uses require_env from src/env_utils.py rather than a bespoke key loader.

• Placeholder API key masked missing credentials. openrouter_classifier.__main__ did os.environ.get("OPENROUTER_API_KEY", "your-api-key-here"), so an unset key silently sent a bogus Authorization: Bearer your-api-key-here header to OpenRouter instead of failing. Now (API_KEY,) = require_env("OPENROUTER_API_KEY"), matching the other entrypoints.

• Untrusted filenames flowed into output paths. _save_image / _save_json interpolated document_name — derived from input filenames and dataset directory names — directly into a path:

  # before: document_name="../../evil" writes outside output_dir
  image_path = self.images_dir / f"{document_name}_page_{page_num:04d}.png"
  # after
  image_path = self.images_dir / f"{sanitize_document_name(document_name)}_page_{page_num:04d}.png"

  sanitize_document_name collapses anything outside [A-Za-z0-9._-] to _, strips leading/trailing ./_, caps length at 200, and raises on names with no usable characters. Normal dataset names (letter_0000123, scientific_report_...) are unchanged.

• Two unbounded HTTP calls. braintrust_metrics_visual.fetch_experiment_results called requests.get for /project and /experiment with no timeout (the paginated POST already had one) — a stalled connection hangs the script forever. Added timeout=60.

• .gitignore secret coverage. .env.local only; now .env.* (keeping !.env.example) plus *.pem, *.key, credentials.json, kaggle.json — the Kaggle download path makes a stray kaggle.json plausible.

Not applicable / not found: no SQL, database, or web/API server exists in the repo, so there is no SQL injection, CORS, debug endpoint, or authentication surface. pip-audit on requirements.txt reports no known vulnerabilities. Remaining non-critical note, left alone deliberately: most requirements use unbounded >= ranges (Pillow>=10.4.0, requests>=2.32.0, ...), which makes builds non-reproducible and exposes the project to a bad upstream release — worth pinning, but that is a dependency-policy decision rather than a fix.

Link to Devin session: https://app.devin.ai/sessions/a3c51c3c047e4e20b46efb208ca46daa
Requested by: @Exios66

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring