mARTin-B78/tts-voice-creator-clone-and-design-2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: close provider credential boundary review

Browse Source
This commit is contained in:
mARTin-B78 2026-09-04 09:08:31 +02:00
parent 87acd20811
commit f14e1d2e92
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@ -31,6 +31,8 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · versioned wi
status/cancellation endpoints with timeout and failure states; existing synchronous callers remain compatible.
- **STT Cancellation Safety.** Queued transcription cancels before consuming the single STT slot, and timed-out
requests keep the device slot held until the underlying worker actually exits.
- **Credential Boundary Review.** Provider credentials are now documented as server-only; only the explicitly
regenerated external caller key crosses to the UI, with no-store delivery and no browser-storage persistence.
- **API Boundary Hardening.** External API authentication is enabled by default, request and mutation limits are
enforced, and settings responses redact provider credentials for non-browser callers.
- **Server-side Provider Credentials.** Provider keys are now masked even for same-origin Settings responses, are

11
TODO.md
View File

@ -17,9 +17,9 @@ the first block before investing in architecture or polish.
### P0 — do first
- [ ] **S — Stop API keys from reaching frontend JavaScript or logs.** Provider keys are now masked in settings
responses and probes use server-side credentials; finish the external-client key handoff and audit remaining
transient input/error paths.
- [x] **S — Stop provider API keys from reaching frontend JavaScript or logs.** Provider keys are masked in settings
responses, probes resolve credentials server-side, and browser storage/log paths are clean. The separate external
caller key is available only through deliberate regeneration, uses `no-store`, and is not retained by the UI.
- [x] **S — Validate uploaded filenames and paths.** Upload endpoints reject traversal, path separators and control
characters before deriving extensions; ZIP imports reject absolute, traversal and malformed archive members.
- [x] **M — Add upload, request-size, temporary-file and concurrent-job limits.** Endpoint-specific upload/request
@ -138,8 +138,9 @@ the first block before investing in architecture or polish.
## P0 — Security
- [ ] Never expose API keys to frontend JavaScript or logs. Provider keys are masked on read and absent from browser
storage; the deliberate external-client key display and transient entry path still need a final design review.
- [x] Never expose provider API keys to frontend JavaScript or logs. Provider keys are masked on read and absent from
browser storage; the external-client key is an intentional, explicit handoff for caller authentication and its
regeneration response is non-cacheable.
- [x] Validate uploaded filenames and paths.
- [x] Strictly validate custom URLs to prevent SSRF, with private destinations available only when explicitly allowed
for local provider/container operation.