Compare commits

..

2 Commits

Author SHA1 Message Date
didericis-codex f5fdc0ea72 fix: satisfy pyright for log redaction tests
lint / lint (push) Successful in 2m42s
test / unit (pull_request) Successful in 54s
test / integration (pull_request) Successful in 26s
2026-06-25 00:15:45 -04:00
didericis-claude ca1f14b855 fix(egress): strip injected Authorization and redact bodies in LOG_FULL path
_log_request and _log_response wrote headers and bodies to stderr verbatim.
_log_request also included the sidecar-injected upstream Authorization value,
exposing live bearer tokens on every allowed request under LOG_FULL.

Apply redact_tokens to all header values and bodies in both log functions;
exclude the authorization header from _log_request entirely since its value
is always a live sidecar-injected credential by the time _log_request runs.

Closes #257
2026-06-25 00:15:45 -04:00
@@ -1,4 +1,4 @@
# PRD 0063: Strengthen outbound exfiltration detection
# PRD prd-new: Strengthen outbound exfiltration detection
- **Status:** Active
- **Author:** claude