lukaszraczylo 95bda3ee3b fix: redact sensitive headers in httplog + restore headless logging ...

P0 #1 — HTTP traffic logger captured Authorization, Cookie, Set-Cookie,
X-Api-Key, X-Auth-Token, X-Csrf-Token, Proxy-Authorization, X-Access-Token
verbatim into log entries (file 0600 + UI subscribers). Bearer tokens
and session cookies were ending up on disk whenever httpLog.includeHeaders
was enabled.

flattenHeaders now redacts:
  - the explicit list above (case-insensitive via http.CanonicalHeaderKey)
  - any header name containing 'token', 'secret', 'password', 'apikey'
Header names remain visible; values become [REDACTED].
Redaction is unconditional and on-by-default — no opt-out flag. Users
who want raw headers can use tcpdump.

P0 #6 — Headless mode without -v silently routed both structured and
stdlib logs to io.Discard. A daemon under launchd/systemd had no way to
report errors. Headless now defaults log destination to os.Stderr; -v
controls only the level (debug vs info). TUI-quiet path is preserved.

Tests in internal/httplog/redact_test.go cover all explicit names,
substring patterns, and case variants.

2026-05-06 10:45:29 +01:00

..

benchmark_test.go

fixup! Update go.mod and go.sum (#48)

2026-02-20 15:39:27 +00:00

logger_test.go

chore: add golangci-lint v2 config and fix linter warnings (#46)

2026-02-13 18:46:27 +00:00

logger.go

fixup! Update go.mod and go.sum (#48)

2026-02-20 15:39:27 +00:00

proxy_test.go

fixup! Update go.mod and go.sum (#48)

2026-02-20 15:39:27 +00:00

proxy.go

fix: redact sensitive headers in httplog + restore headless logging

2026-05-06 10:45:29 +01:00

redact_test.go

fix: redact sensitive headers in httplog + restore headless logging

2026-05-06 10:45:29 +01:00