412d7b82e9
Critical fixes: - Add SanitizeConnectionString() in storage/db_connect.go to remove passwords - Add SecureEnvVar() in api/factory.go to clear env vars after reading (JWT_SECRET) - Clear DB password from config after connection Logging improvements: - Enhance logging/sanitize.go with patterns for: - PostgreSQL connection strings - Generic connection string passwords - HTTP Authorization headers - Private keys CLI security: - Add --security-audit flag to api-server for security checks: - Config file permissions - Exposed environment variables - Running as root - API key file permissions - Add warning when --api-key flag used (process list exposure) Files changed: - internal/storage/db_connect.go - internal/api/factory.go - internal/logging/sanitize.go - internal/auth/flags.go - cmd/api-server/main.go |
||
|---|---|---|
| .. | ||
| dataset.go | ||
| db_connect.go | ||
| db_experiments.go | ||
| db_jobs.go | ||
| db_metrics.go | ||
| migrate.go | ||
| paths.go | ||
| schema_embed.go | ||
| schema_postgres.sql | ||
| schema_sqlite.sql | ||