Skip to content

feat(security): keep secret values out of API key responses #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
agentHits merged 5 commits into from
Oct 12, 2026
Merged

feat(security): keep secret values out of API key responses #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e3a8bd1
feat(security): keep secret values out of API key responses
agentHits Oct 12, 2026
167c169
fix(security): keep image tags, ports and config structure readable f…
agentHits Oct 12, 2026
d13a125
feat(security): let API keys edit compose files and mounted files wit…
agentHits Oct 12, 2026
eb036f5
fix(security): scrub values written with spaces around the separator …
agentHits Oct 12, 2026
485c516
feat(security): hide generated-looking values under any name in mount…
agentHits Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions apps/dokploy/__test__/placement/deploy-target-boundary.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,17 @@ vi.mock("ai", () => ({
generateText: vi.fn(),
}));

vi.mock("@dokploy/server/services/known-secrets", async () => {
const { buildKnownSecretMatcher } = await import(
"@dokploy/server/utils/security/secret-scrub"
);
return {
getKnownSecretMatcher: async () =>
buildKnownSecretMatcher(["Zx9-sentinel-Value42"]),
resetKnownSecretMatcherCache: () => {},
};
});

vi.mock("@dokploy/server/db", () => ({
db: {
query: {},
Expand Down Expand Up @@ -539,6 +550,36 @@ describe("deploy target placement ownership boundary", () => {
);
});

it("sends logs to the AI provider without secret values", async () => {
vi.mocked(selectAIProvider).mockReturnValueOnce(
vi.fn(() => "model") as never,
);
vi.mocked(generateText).mockResolvedValueOnce({
text: "ok",
} as Awaited<ReturnType<typeof generateText>>);
aiServiceMocks.getAiSettingById.mockResolvedValueOnce({
aiId: "ai-1",
apiKey: "secret",
apiUrl: "https://api.openai.com/v1",
isEnabled: true,
model: "gpt-4o-mini",
name: "OpenAI",
organizationId: "org-1",
});

await aiRouter.createCaller(createContext("admin")).analyzeLogs({
aiId: "ai-1",
context: "runtime",
logs: "connect failed with Zx9-sentinel-Value42\nDB_PASS=hunter2-hunter2\nlistening on 3000",
});

const prompt = vi.mocked(generateText).mock.calls.at(-1)?.[0].prompt;
expect(prompt).toContain("listening on 3000");
expect(prompt).toContain("connect failed with __DOKPLOY_REDACTED_SECRET__");
expect(prompt).not.toContain("Zx9-sentinel-Value42");
expect(prompt).not.toContain("hunter2-hunter2");
});

it("denies AI suggestions for inaccessible servers before server metadata reaches AI service", async () => {
await expect(
aiRouter.createCaller(createContext()).suggest({
Expand Down
Loading