AltimateAI / AltimateAI/altimate-code
security: broaden headersCommand failure-message masking beyond pattern-based maskString
未關閉
- 主要語言
- TypeScript
- 星號
- 811
- 分支
- 134
- 平均合併
- 3 天 2 小時
- 30 天內合併 PR
- 50
描述
Found during v0.9.1 release review (CTO). `Telemetry.maskString()` only redacts known shapes (sk-…, Bearer , emails, hosts). A verbose auth CLI in `headersCommand` that prints a bare unprefixed token to stderr on failure would surface unmasked in `status.error`/`mcp list`/logs. Consider entropy-based redaction for the headersCommand failure path, or document the residual risk.
貢獻指南
評估
這個 Issue 還沒有評估資料。