feat: security hardening — URL secret redaction + bounded error-body reads - #63

Merged

lesnik512 merged 12 commits into

mainfrom

feat/security-hardening

Jun 14, 2026

Commits on Jun 14, 2026

docs(planning): security-hardening design (redaction + bounded error body)

lesnik512
and
claude
committed
361a5ee
docs(planning): security-hardening implementation plan

lesnik512
and
claude
committed
e842322
feat(redaction): URL sanitizer (strip userinfo + mask sensitive query keys)

lesnik512
and
claude
committed
064cedc
fix(errors): mask query secrets in StatusError messages via redact_url

lesnik512
and
claude
committed
b59d436
fix(observability): mask query secrets in resilience event URLs

lesnik512
and
claude
committed
ff00a54
fix(redaction): mask secrets in URL fragment + whitespace-padded keys

lesnik512
and
claude
committed
c6d8b86
feat(errors): add ResponseTooLargeError (opt-in error-body cap)

lesnik512
and
claude
committed
555bd1f
feat(client): opt-in max_error_body_bytes bounds the stream() error pre-read

lesnik512
and
claude
committed
68ae51f
docs: trust_env + bounded-error-body + header-reachability callouts

lesnik512
and
claude
committed
a355b2f
test(stream): mark unreachable stream-body lines no-cover

lesnik512
and
claude
committed
8c23503
test: exclude pytest.fail() lines from coverage via pyproject

lesnik512
and
claude
committed
eface88
refactor(observability): redact url at the _emit_event chokepoint

lesnik512
and
claude
committed
7b69f19