From f14e1d2e92a1102940249b3130e6bed020124662 Mon Sep 17 00:00:00 2001
From: mARTin-B78 <mail@martin-bierschenk.de>
Date: Fri, 4 Sep 2026 09:08:31 +0200
Subject: [PATCH] docs: close provider credential boundary review

---
 CHANGELOG.md |  2 ++
 TODO.md      | 11 ++++++-----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f16e0b5..46869d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,8 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · versioned wi
   status/cancellation endpoints with timeout and failure states; existing synchronous callers remain compatible.
 - **STT Cancellation Safety.** Queued transcription cancels before consuming the single STT slot, and timed-out
   requests keep the device slot held until the underlying worker actually exits.
+- **Credential Boundary Review.** Provider credentials are now documented as server-only; only the explicitly
+  regenerated external caller key crosses to the UI, with no-store delivery and no browser-storage persistence.
 - **API Boundary Hardening.** External API authentication is enabled by default, request and mutation limits are
   enforced, and settings responses redact provider credentials for non-browser callers.
 - **Server-side Provider Credentials.** Provider keys are now masked even for same-origin Settings responses, are
diff --git a/TODO.md b/TODO.md
index 36b0fca..5da6ded 100644
--- a/TODO.md
+++ b/TODO.md
@@ -17,9 +17,9 @@ the first block before investing in architecture or polish.
 
 ### P0 — do first
 
-- [ ] **S — Stop API keys from reaching frontend JavaScript or logs.** Provider keys are now masked in settings
-  responses and probes use server-side credentials; finish the external-client key handoff and audit remaining
-  transient input/error paths.
+- [x] **S — Stop provider API keys from reaching frontend JavaScript or logs.** Provider keys are masked in settings
+  responses, probes resolve credentials server-side, and browser storage/log paths are clean. The separate external
+  caller key is available only through deliberate regeneration, uses `no-store`, and is not retained by the UI.
 - [x] **S — Validate uploaded filenames and paths.** Upload endpoints reject traversal, path separators and control
   characters before deriving extensions; ZIP imports reject absolute, traversal and malformed archive members.
 - [x] **M — Add upload, request-size, temporary-file and concurrent-job limits.** Endpoint-specific upload/request
@@ -138,8 +138,9 @@ the first block before investing in architecture or polish.
 
 ## P0 — Security
 
-- [ ] Never expose API keys to frontend JavaScript or logs. Provider keys are masked on read and absent from browser
-  storage; the deliberate external-client key display and transient entry path still need a final design review.
+- [x] Never expose provider API keys to frontend JavaScript or logs. Provider keys are masked on read and absent from
+  browser storage; the external-client key is an intentional, explicit handoff for caller authentication and its
+  regeneration response is non-cacheable.
 - [x] Validate uploaded filenames and paths.
 - [x] Strictly validate custom URLs to prevent SSRF, with private destinations available only when explicitly allowed
   for local provider/container operation.