Parent governance program
Focused CWE-209 execution unit under #898, sibling to #912. Where #912 covers the Python surface (src/agents/**, src/youtube_extension/**, src/uvai/ml), this unit covers the Next.js/TypeScript API route surface under apps/web/src/app/api/**. The two scopes are disjoint; neither supersedes the other.
Objective
Stop third-party error text (OpenAI Realtime, Stripe SDK) from being returned verbatim to HTTP callers, while preserving full server-side diagnostics via console.error / kaizenObserve.
Why this is urgent
Five of the six affected routes are on the unauthenticated public allowlist PUBLIC_API_EXACT in apps/web/src/lib/auth-paths.ts (lines 13–35). Any internet user can trigger these error branches with no credentials and read the leaked upstream text.
Observed leak content:
realtime/session — mirrors upstream.status and returns the OpenAI body as details. On 401 that body echoes a partial key: Incorrect API key provided: sk-proj-****ABCD; it also carries org/project IDs and quota state.billing/* — returns raw Stripe err.message: No such price: 'price_...', Invalid API Key provided: sk_live_****ABCD, plus signature-verification internals (tolerance window, scheme).
Declared file scope
apps/web/src/app/api/realtime/session/route.tsapps/web/src/app/api/billing/checkout/route.tsapps/web/src/app/api/billing/activate/route.tsapps/web/src/app/api/billing/renew/route.tsapps/web/src/app/api/billing/webhook/route.tsapps/web/src/app/api/transcribe/route.ts- corresponding tests under
apps/web/src/app/api/__tests__/
Acceptance criteria
- No response body on any listed route contains upstream/SDK text.
- Every suppressed message still reaches
console.error (and kaizenObserve where the route already used it).
realtime/session returns a fixed 502 rather than mirroring upstream.status, since the upstream status itself signals account state.- Each error response carries a static message plus a machine-readable code.
- Tests assert the absence of the specific leaked tokens, not merely a status code.
- No client-contract break: existing
data.error ?? '<fallback>' consumers keep working.
Out of scope
.github/workflows/pr-checks.yml, scripts/ci/agent_completion_gate.py, .github/agent-lock/trusted-publishers.json.
Parent governance program
Focused CWE-209 execution unit under #898, sibling to #912. Where #912 covers the Python surface (
src/agents/**,src/youtube_extension/**,src/uvai/ml), this unit covers the Next.js/TypeScript API route surface underapps/web/src/app/api/**. The two scopes are disjoint; neither supersedes the other.Objective
Stop third-party error text (OpenAI Realtime, Stripe SDK) from being returned verbatim to HTTP callers, while preserving full server-side diagnostics via
console.error/kaizenObserve.Why this is urgent
Five of the six affected routes are on the unauthenticated public allowlist
PUBLIC_API_EXACTinapps/web/src/lib/auth-paths.ts(lines 13–35). Any internet user can trigger these error branches with no credentials and read the leaked upstream text.Observed leak content:
realtime/session— mirrorsupstream.statusand returns the OpenAI body asdetails. On 401 that body echoes a partial key:Incorrect API key provided: sk-proj-****ABCD; it also carries org/project IDs and quota state.billing/*— returns raw Stripeerr.message:No such price: 'price_...',Invalid API Key provided: sk_live_****ABCD, plus signature-verification internals (tolerance window, scheme).Declared file scope
apps/web/src/app/api/realtime/session/route.tsapps/web/src/app/api/billing/checkout/route.tsapps/web/src/app/api/billing/activate/route.tsapps/web/src/app/api/billing/renew/route.tsapps/web/src/app/api/billing/webhook/route.tsapps/web/src/app/api/transcribe/route.tsapps/web/src/app/api/__tests__/Acceptance criteria
console.error(andkaizenObservewhere the route already used it).realtime/sessionreturns a fixed502rather than mirroringupstream.status, since the upstream status itself signals account state.data.error ?? '<fallback>'consumers keep working.Out of scope
.github/workflows/pr-checks.yml,scripts/ci/agent_completion_gate.py,.github/agent-lock/trusted-publishers.json.