Description
Remediate the six scan findings involving URL disclosure, reflected response bodies, Pyroscope TLS fallback, AWS STS endpoint construction and redirects, and credential-bearing HTTP origin policy.
Acceptance Criteria
- #1 Credential-bearing URLs are consistently redacted from diagnostics, logs, traces, and effective config
- #2 Credential-bearing clients do not reflect untrusted remote response bodies into logs
- #3 Pyroscope fails closed when explicit TLS policy cannot be constructed
- #4 AWS region input cannot select a non-AWS STS authority
- #5 Ambient AWS credential exchanges do not follow response-directed redirects
- #6 Headscale, annotations, node-metrics, and S3 credential clients enforce secure origins and safe redirect policy
Definition of Done
- #1 go build ./… && go vet ./… && go test -race ./…
- #2 golangci-lint run
- #3 scripts/regen-generated.sh (only if a generated artifact’s inputs changed)
Implementation Plan
Centralize lower-trust URL rendering and redirect refusal, remove response bodies from operational errors, validate AWS authorities before token reads, and fail closed on explicit TLS policy; verify every sibling client with canary tests.
Resume only to clear the shared full-suite workflow-contract gate; no outbound-security implementation changes.
Implementation Notes
Outbound security canary tests, independent bypass review, govulncheck, and affected-package race tests pass. Final go test -race ./… is blocked only by unchanged internal/ci workflow-contract assertions outside this lane.
Shared workflow-contract blocker cleared: full build, vet, race suite, lint, and actionlint passed on 2026-08-25.
Final Summary
Closed URL and response-body diagnostic leaks, Pyroscope trust fallback, STS authority injection, ambient redirect replay, and credential-client origin gaps.
The complete repository gate now passes.