feat: security hardening — URL secret redaction + bounded error-body reads#63

Merged

lesnik512 merged 12 commits into

mainfrom

feat/security-hardening

Jun 14, 2026

Commits on Jun 14, 2026

docs(planning): security-hardening design (redaction + bounded error body)

lesnik512
and
claude
committed
docs(planning): security-hardening implementation plan

lesnik512
and
claude
committed
feat(redaction): URL sanitizer (strip userinfo + mask sensitive query keys)

lesnik512
and
claude
committed
fix(errors): mask query secrets in StatusError messages via redact_url

lesnik512
and
claude
committed
fix(observability): mask query secrets in resilience event URLs

lesnik512
and
claude
committed
fix(redaction): mask secrets in URL fragment + whitespace-padded keys

lesnik512
and
claude
committed
feat(errors): add ResponseTooLargeError (opt-in error-body cap)

lesnik512
and
claude
committed
feat(client): opt-in max_error_body_bytes bounds the stream() error pre-read

lesnik512
and
claude
committed
docs: trust_env + bounded-error-body + header-reachability callouts

lesnik512
and
claude
committed
test(stream): mark unreachable stream-body lines no-cover

lesnik512
and
claude
committed
test: exclude pytest.fail() lines from coverage via pyproject

lesnik512
and
claude
committed
refactor(observability): redact url at the _emit_event chokepoint

lesnik512
and
claude
committed