jfraeysd/fetch_ml
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
fetch_ml/cmd/api-server
History
Jeremie Fraeys 412d7b82e9
security: implement comprehensive secrets protection 
Critical fixes:
- Add SanitizeConnectionString() in storage/db_connect.go to remove passwords
- Add SecureEnvVar() in api/factory.go to clear env vars after reading (JWT_SECRET)
- Clear DB password from config after connection

Logging improvements:
- Enhance logging/sanitize.go with patterns for:
  - PostgreSQL connection strings
  - Generic connection string passwords
  - HTTP Authorization headers
  - Private keys

CLI security:
- Add --security-audit flag to api-server for security checks:
  - Config file permissions
  - Exposed environment variables
  - Running as root
  - API key file permissions
- Add warning when --api-key flag used (process list exposure)

Files changed:
- internal/storage/db_connect.go
- internal/api/factory.go
- internal/logging/sanitize.go
- internal/auth/flags.go
- cmd/api-server/main.go
2026-02-18 16:18:09 -05:00
..
main.go security: implement comprehensive secrets protection 2026-02-18 16:18:09 -05:00
README.md feat(api): refactor websocket handlers; add health and prometheus middleware 2026-01-05 12:31:07 -05:00

README.md

API Server

WebSocket API server for the ML CLI tool...

Usage

./bin/api-server --config configs/api/dev.yaml

Endpoints

  • GET /health - Health check
  • WS /ws - WebSocket endpoint for CLI communication

Binary Protocol

See CLI README for protocol details.

Configuration

Uses the same configuration file as the worker. Experiment base path is read from base_path configuration key.

Example

# Start API server
./bin/api-server --listen :9100

# In another terminal, test with CLI
./cli/zig-out/bin/ml status