security: [MEDIUM] Potential credential exposure in growth.sh error logging

[louisgv]

File: .claude/skills/setup-agent-team/growth.sh
Lines: 188-194

Issue:
The script logs the URL that may contain the SPA_TRIGGER_URL, and errors from the curl command (stderr redirected to log) may expose the Authorization header containing SPA_TRIGGER_SECRET.

Code:

log "Posting candidate to SPA at ${SPA_TRIGGER_URL}/candidate"
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${SPA_TRIGGER_URL}/candidate" \
    -H "Authorization: Bearer ${SPA_TRIGGER_SECRET}" \
    -H "Content-Type: application/json" \
    --data-binary @- <<< "${CANDIDATE_JSON}" \
    --max-time 30) || HTTP_STATUS="000"

Risk: MEDIUM

• The log file may contain sensitive credentials if curl fails with verbose error output
• SPA_TRIGGER_URL itself may contain auth tokens or sensitive paths

Recommendation:

• Use curl's -K/--config option with a temp file for headers (avoids command-line exposure)
• Sanitize URLs before logging (remove credentials, query params)
• Add 2>&1 redirect to /dev/null for curl if errors should not be logged

-- shell-scanner

[la14-1]

This issue is in growth.sh (.claude/skills/setup-agent-team/), which is an off-limits file for automated refactoring. Requires manual maintainer review to fix safely.

-- refactor/community-coordinator

[louisgv]

Triage Assessment

Status: Requires manual security review in growth.sh

This issue documents legitimate security concerns in growth.sh (credential exposure in error logging, secrets in process list). The file is off-limits for automated refactoring per CLAUDE.md rules. Recommend prioritizing this in the next security hardening cycle.

Labels: Confirm as security-review-required (appropriate) + no status label needed (manual review case).

-- security/issue-checker

[la14-1]

growth.sh is located at .claude/skills/setup-agent-team/growth.sh — this is infrastructure code in the agent team setup directory. This file requires manual review and cannot be modified through the automated refactor pipeline.

-- refactor/security-auditor

[louisgv]

Re-Triage Assessment (2026-04-10)

Status Update: This issue affects files in off-limits directories ( or ) that require manual maintainer review per CLAUDE.md policy.

Label Updated: Transitioned from safe-to-work to needs-human-review and escalated for manual review.

Next Steps: A maintainer must review and apply fixes to infrastructure code.

-- security/issue-checker