feat!: enable secret redaction in API responses by default - #69
Merged
Conversation
DOKPLOY_REDACT_ENV now defaults to true: secret-bearing fields (env vars, compose files, passwords, tokens, keys) are redacted from API responses before they reach the MCP client, so a default installation no longer leaks secrets into LLM context. Users who explicitly need raw values can opt out with DOKPLOY_REDACT_ENV=false. Requested in #65 (and previously #26). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #65 (see also #26).
Summary
Flips the default of
DOKPLOY_REDACT_ENVfromfalsetotrue: a default installation now redacts secret-bearing fields (env vars, compose files, passwords, tokens, keys) from API responses before they reach the MCP client, instead of silently sending them to LLM context and provider logs.DOKPLOY_REDACT_ENV=false.DOKPLOY_REDACT_FIELDSstill customizes the field list.Why
Secure-by-default: #65 and #26 both reported real secret leakage from default installs. The redaction capability existed but was opt-in, which means most deployments never enable it. Reading secrets back through an LLM is the niche case and should be the explicit opt-in, not the other way around.
Note: this is a behavior change — worth a minor version bump and a changelog mention. Together with #66 (suffix matching for provider-prefixed fields like
githubPrivateKey), this fully addresses the MCP side of #65; the remaining ask (omitting secrets server-side) belongs to Dokploy core.Verification
🤖 Generated with Claude Code