Sub-issue of #64046
Maintainer requirements
- Scope: ensure all config response surfaces apply the same secret-redaction policy.
- Deliverable: unified redaction behavior for
parsed/source/runtime style snapshots.
- Acceptance criteria: no plaintext secrets in read-scoped config responses; regression tests for provider keys, gateway tokens, URL tokens, and SecretRef variants.
Problem
browser.cdpUrl and browser.profiles.*.cdpUrl bypass all three redaction gates:
| Redaction gate |
Why cdpUrl is missed |
Schema .register(sensitive) |
Not registered (zod-schema.ts lines 360, 387) |
Path-name pattern (/token$/i, /api.?key$/i, …) |
cdpUrl doesn't match any suffix |
URL-path match (.baseUrl, .httpUrl, mcp.servers.*.url) |
.cdpUrl not listed in isSensitiveUrlConfigPath() |
Result: config.get returns plaintext credentials in all five snapshot fields (raw, parsed, sourceConfig, runtimeConfig, resolved).
cdpUrl credential formats (from docs/tools/browser.md)
| Format |
Example |
| Query token |
https://chrome.browserless.io?token=<secret> |
| HTTP Basic auth |
https://user:[email protected] |
"Treat remote CDP URLs/tokens as secrets" — docs/tools/browser.md
Field coverage audit
| Config path |
Embeds credentials? |
Covered? |
models.providers.*.baseUrl |
Yes |
✅ |
mcp.servers.*.url |
Yes |
✅ |
gateway.auth.token / .password |
Yes |
✅ |
gateway.remote.token / .password |
Yes |
✅ |
cron.webhookToken |
Yes |
✅ |
skills.*.apiKey |
Yes |
✅ |
browser.cdpUrl |
Yes |
❌ |
browser.profiles.*.cdpUrl |
Yes |
❌ |
Related issues
Sub-issue of #64046
Maintainer requirements
Problem
browser.cdpUrlandbrowser.profiles.*.cdpUrlbypass all three redaction gates:cdpUrlis missed.register(sensitive)zod-schema.tslines 360, 387)/token$/i,/api.?key$/i, …)cdpUrldoesn't match any suffix.baseUrl,.httpUrl,mcp.servers.*.url).cdpUrlnot listed inisSensitiveUrlConfigPath()Result:
config.getreturns plaintext credentials in all five snapshot fields (raw,parsed,sourceConfig,runtimeConfig,resolved).cdpUrl credential formats (from
docs/tools/browser.md)https://chrome.browserless.io?token=<secret>https://user:[email protected]Field coverage audit
models.providers.*.baseUrlmcp.servers.*.urlgateway.auth.token/.passwordgateway.remote.token/.passwordcron.webhookTokenskills.*.apiKeybrowser.cdpUrlbrowser.profiles.*.cdpUrlRelated issues
config.getreturns unredacted API keys insourceConfig/runtimeConfig