jfraeysd/fetch_ml
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
fetch_ml/internal
History
Jeremie Fraeys 412d7b82e9
security: implement comprehensive secrets protection 
Critical fixes:
- Add SanitizeConnectionString() in storage/db_connect.go to remove passwords
- Add SecureEnvVar() in api/factory.go to clear env vars after reading (JWT_SECRET)
- Clear DB password from config after connection

Logging improvements:
- Enhance logging/sanitize.go with patterns for:
  - PostgreSQL connection strings
  - Generic connection string passwords
  - HTTP Authorization headers
  - Private keys

CLI security:
- Add --security-audit flag to api-server for security checks:
  - Config file permissions
  - Exposed environment variables
  - Running as root
  - API key file permissions
- Add warning when --api-key flag used (process list exposure)

Files changed:
- internal/storage/db_connect.go
- internal/api/factory.go
- internal/logging/sanitize.go
- internal/auth/flags.go
- cmd/api-server/main.go
2026-02-18 16:18:09 -05:00
..
api security: implement comprehensive secrets protection 2026-02-18 16:18:09 -05:00
audit feat(tracking): add pluggable tracking backends and audit support 2026-01-05 12:33:57 -05:00
auth security: implement comprehensive secrets protection 2026-02-18 16:18:09 -05:00
config refactor: replace panic with error returns and update maintenance 2026-02-18 14:44:21 -05:00
container feat: implement research-grade maintainability phases 1,3,4,7 2026-02-18 15:27:50 -05:00
controller Fix multi-user authentication and clean up debug code 2025-12-06 12:35:32 -05:00
domain feat: implement research-grade maintainability phases 1,3,4,7 2026-02-18 15:27:50 -05:00
envpool feat(worker): add integrity checks, snapshot staging, and prewarm support 2026-01-05 12:31:13 -05:00
errtypes feat: implement research-grade maintainability phases 1,3,4,7 2026-02-18 15:27:50 -05:00
experiment refactor: Export SelectDependencyManifest for API helpers 2026-02-17 16:45:59 -05:00
fileutil Fix multi-user authentication and clean up debug code 2025-12-06 12:35:32 -05:00
jupyter security: prevent Jupyter token exposure in logs 2026-02-18 16:11:50 -05:00
logging security: implement comprehensive secrets protection 2026-02-18 16:18:09 -05:00
manifest feat: implement research-grade maintainability phases 2, 5, 8, 10 2026-02-18 15:34:28 -05:00
metrics refactor: Phase 6 - Complete migration, remove legacy files 2026-02-17 14:39:48 -05:00
middleware feat(api): refactor websocket handlers; add health and prometheus middleware 2026-01-05 12:31:07 -05:00
network refactor(dependency-hygiene): Move path functions from config to storage 2026-02-17 21:15:23 -05:00
prommetrics feat(api): refactor websocket handlers; add health and prometheus middleware 2026-01-05 12:31:07 -05:00
queue refactor: move queue spec tests to tests/unit/ and fix test failures 2026-02-18 15:45:30 -05:00
resources feat(worker): add integrity checks, snapshot staging, and prewarm support 2026-01-05 12:31:13 -05:00
storage security: implement comprehensive secrets protection 2026-02-18 16:18:09 -05:00
telemetry Fix multi-user authentication and clean up debug code 2025-12-06 12:35:32 -05:00
tracking feat(tracking): add pluggable tracking backends and audit support 2026-01-05 12:33:57 -05:00
worker feat: implement research-grade maintainability phases 2, 5, 8, 10 2026-02-18 15:34:28 -05:00