Redact API keys from error technical-details disclosure
All checks were successful
Deploy / deploy (push) Successful in 27s

SABnzbd and Tautulli embed their API key in the request URL, so it
was showing up verbatim in the raw exception text under "Technical
details" on the dashboard — visible to anyone with the study-room
password. Added a redact_secrets filter that strips apikey/token/
password query params before the raw string is rendered.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Barely Removable 2026-08-26 05:11:28 -07:00
parent 2e1f8efa33
commit 951914dd69
2 changed files with 15 additions and 1 deletions

View file

@ -980,7 +980,7 @@
{% if raw %}
<details class="error-detail">
<summary>Technical details</summary>
<pre>{{ raw }}</pre>
<pre>{{ raw | redact_secrets }}</pre>
</details>
{% endif %}
</div>