[rab1prasad]

Echo-scan findings: secrets in logs, exception text in API errors, public provider health checks.

• Telephony callbacks (status, details GET/POST) log field names only, not the form/query values that carry caller and callee phone numbers. verify_breeze_token logs the merchant id, not platformToken or breezeTokenData.
• Catch-all 5xx responses return a fixed message; the exception stays in the logs. 22 sites flagged by the scan plus 3 it missed (DevCycle webhook, per-lead delete result, admin template purge). DragonTTS 502 no longer shows the internal service address. Deliberate 4xx messages from our own validation errors are unchanged.
• /health/gemini, /health/daily and /health/azure-openai require an admin login, so anonymous callers can no longer trigger live provider calls on our keys. No health response carries error text, only error_type. /health, /health/database and /health/redis stay public.

Summary by CodeRabbit

• Security
  • Error responses no longer expose internal exception messages, while server-side logging retains diagnostic details.
  • Callback logs and token verification logs avoid recording sensitive request values and credentials.
  • Provider health checks now require administrator access; failure responses limit the details exposed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7d50ea8c-064c-4135-9de1-72b2589dcbee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.