Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[bug] Session traces persist API credentials in plaintext headers

Closed
  • Is something wrong?
#118 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
security

Research direction

Start at buildTraceRecord and cloneRequestHeaders, then inspect FetchHttpTransport and SessionTraceStore, using the isolated production-transport regression test described in the issue. Verify that persisted trace JSON redacts authorization, x-api-key, and response cookies across header casing, response status, and streaming mode while credentials still reach the endpoint.

Written by the indexing model from the issue text.

Description

Version and environment

main at 87c344501f5960cda6bf9f47eec5af0a4664cdba (1.0.0), Node.js 26.8.1, macOS 26.5.2 arm64.

Reproduction
  1. Create a FetchHttpTransport with a real SessionTraceStore targeting a temporary storage root.
  2. Send a request with complete trace metadata and dummy authorization: Bearer fake-key-for-regression-only / x-api-key: fake-anthropic-key headers. Mock only the fetch response; do not use real credentials or call a model endpoint.
  3. Read the generated sessions/s1/trace/span1.json.
  4. Both dummy credentials appear verbatim in request.headers.
Expected behavior

Authentication credentials should reach the model endpoint but be redacted from persisted diagnostic headers, regardless of header-name casing, response status, or streaming mode.

Actual behavior and cause

buildTraceRecord copies request headers with cloneRequestHeaders without redaction. OpenAI-compatible requests contain a bearer token and Anthropic requests contain x-api-key. Session tracing is enabled by default in BUILTIN_CLI_DEFAULTS.

Trace files use mode 0600, so this is not a claim of unauthenticated remote access. The problem is that diagnostic files contain reusable API credentials and can disclose them if copied or shared. Response cookies should likewise be redacted from trace headers.

Verification

An isolated regression test using the production transport and filesystem trace store fails on current main because the saved JSON contains the dummy credential.

  • Searched existing issues and PRs for duplicates.
  • Read CONTRIBUTING.md.
Dominant language
TypeScript
Stars
471
Forks
42
Avg merge
18h 11m
Merged PRs (30d)
22

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stepfun-ai/Step-Code

All issues in stepfun-ai/Step-Code

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.