Repository navigation

feat: security hardening — URL secret redaction + bounded error-body reads - #63

Merged

lesnik512 merged 12 commits into

mainfrom

feat/security-hardening

Jun 14, 2026

Merged

feat: security hardening — URL secret redaction + bounded error-body reads#63
lesnik512 merged 12 commits into
mainfrom
feat/security-hardening

Commits on Jun 14, 2026
- docs(planning): security-hardening design (redaction + bounded error body)
  
  lesnik512
  and
  claude
  committed
  361a5ee
- docs(planning): security-hardening implementation plan
  
  lesnik512
  and
  claude
  committed
  e842322
- feat(redaction): URL sanitizer (strip userinfo + mask sensitive query keys)
  
  lesnik512
  and
  claude
  committed
  064cedc
- fix(errors): mask query secrets in StatusError messages via redact_url
  
  lesnik512
  and
  claude
  committed
  b59d436
- fix(observability): mask query secrets in resilience event URLs
  
  lesnik512
  and
  claude
  committed
  ff00a54
- fix(redaction): mask secrets in URL fragment + whitespace-padded keys
  
  lesnik512
  and
  claude
  committed
  c6d8b86
- feat(errors): add ResponseTooLargeError (opt-in error-body cap)
  
  lesnik512
  and
  claude
  committed
  555bd1f
- feat(client): opt-in max_error_body_bytes bounds the stream() error pre-read
  
  lesnik512
  and
  claude
  committed
  68ae51f
- docs: trust_env + bounded-error-body + header-reachability callouts
  
  lesnik512
  and
  claude
  committed
  a355b2f
- test(stream): mark unreachable stream-body lines no-cover
  
  lesnik512
  and
  claude
  committed
  8c23503
- test: exclude pytest.fail() lines from coverage via pyproject
  
  lesnik512
  and
  claude
  committed
  eface88
- refactor(observability): redact url at the _emit_event chokepoint
  
  lesnik512
  and
  claude
  committed
  7b69f19