security(llm): GET /api/llm/config redacts credentials in the nested backend.llm subtree (#18193) by mrveiss · Pull Request #18219 · mrveiss/AutoBot-AI

test(security): GET /config waivers record the operator-set key leak, and every unaudited response-model site cites #17899 (#17899)

mrveiss

committed

cbafc97

test(guards): make exclusion matching path-aware and per-module (#17865)

mrveiss

committed

ca56555

test(guards): the staleness check disagreed with the violation check (#17865)

mrveiss

committed

de6fb04

test(guards): contrast cases for path-aware exclusion and per-module constants (#17865)

mrveiss

committed

336f65e

security(llm): GET /api/llm/config redacts credentials in the nested backend.llm subtree through the canonical redactor (#18193)

mrveiss

committed

6cab4cd

security(llm): /current is redacted too, and redact_nested masks credential URLs, scans plain strings and threads BROAD into query params (#18193)

mrveiss

committed

45000be

security(llm): GET /api/llm/config is admin-only, as decided on #18193 (#18193)

mrveiss

committed

04b99a1

security(llm): GET /api/llm/current returns only the active model and provider; the full tree stays admin-only on /config (#18193)

mrveiss

committed

f60ee9a

docs(api): /llm/current returns only model and provider, and /llm/config is admin-only and redacted (#18193)

mrveiss

committed

6c1e767

fix(llm): GET /api/llm/current reports the active model and provider, not the default (#18215)

mrveiss

committed

4c8713c

fix(llm): /current's cloud fallback and default-model test are explicit (#18215)

mrveiss

committed

013d7bb

fix(redaction): THREAT_MODEL anchors follow redact_text/redact_mapping, and api.ts carries the new /config docstring (#17899)

mrveiss

committed

f0c9745

fix(redaction): user-only URL userinfo masked under ordinary keys; all only on collections; ancestor exclusions cover descendants (#17899)

mrveiss

committed

54d5869

fix(redaction): redact_nested masks the whole URL userinfo, user and password, under any key (#17899)

mrveiss

committed

0037917

Navigation Menu

Repository navigation

security(llm): GET /api/llm/config redacts credentials in the nested backend.llm subtree (#18193) - #18219

security(llm): GET /api/llm/config redacts credentials in the nested backend.llm subtree (#18193)#18219
mrveiss merged 14 commits into
mainfrom
issue-17899-config-audit

Commits on Oct 10, 2026

test(security): GET /config waivers record the operator-set key leak, and every unaudited response-model site cites #17899 (#17899)

test(guards): make exclusion matching path-aware and per-module (#17865)

test(guards): the staleness check disagreed with the violation check (#17865)

test(guards): contrast cases for path-aware exclusion and per-module constants (#17865)

security(llm): GET /api/llm/config redacts credentials in the nested backend.llm subtree through the canonical redactor (#18193)

security(llm): /current is redacted too, and redact_nested masks credential URLs, scans plain strings and threads BROAD into query params (#18193)

security(llm): GET /api/llm/config is admin-only, as decided on #18193 (#18193)

security(llm): GET /api/llm/current returns only the active model and provider; the full tree stays admin-only on /config (#18193)

docs(api): /llm/current returns only model and provider, and /llm/config is admin-only and redacted (#18193)

fix(llm): GET /api/llm/current reports the active model and provider, not the default (#18215)

fix(llm): /current's cloud fallback and default-model test are explicit (#18215)

fix(redaction): THREAT_MODEL anchors follow redact_text/redact_mapping, and api.ts carries the new /config docstring (#17899)

fix(redaction): user-only URL userinfo masked under ordinary keys; all only on collections; ancestor exclusions cover descendants (#17899)

fix(redaction): redact_nested masks the whole URL userinfo, user and password, under any key (#17899)