[abrichr]

First of six fixes from an external review of #1269 (the API step). This is the security one. It is independent of the API-step stack and targets main.

Bug

network_capture.redact found secret and token names only in form fields and URL queries. As a result:

• a JSON login body ({"user": {"password": ...}}) kept the password in network.jsonl;
• a token that only a response carried (a login's access_token, a Set-Cookie value) was missed wherever later traffic echoed it.

Fix

• Names are now read in JSON request and response bodies at any depth. In a JSON body, a password-like or token-like field is replaced field by field, whatever the length of its value. Every value found is then withheld wherever else it appears.
• Set-Cookie values and Authorization credentials are kept in memory only, and withheld wherever a body, URL or script echoes them (<session:cookie>, <session:authorization>). Headers are still never written.
• The name patterns now also cover session, api_key, jwt, bearer, authorization, passphrase and private_key, plus exactly pin, otp, sid and auth.
• NETWORK_CAPTURE.md (the file contract) and API_TIER.md are updated.

Tests

tests/test_network_capture_redact_json.py (new) runs a synthetic JSON login through the real NetworkCapture path into network.jsonl:

• no password, access token, refresh token, Set-Cookie value or bearer credential survives anywhere;
• a 3-character JSON secret is withheld by its field name;
• nested lists are read.

All three tests fail on main. The existing capture, proposal and actuator tests still pass (34 with the new ones).

Synthetic values only.

🤖 Generated with Claude Code