Security EN

Security

English | 简体中文

---

The SDK is built for production environments where credentials grant access to live enterprise accounts.

---

Credential Redaction

The SDK redacts well-known credential headers, plus any header whose name contains token or secret, from every record it logs. NewRedactingHandler extends the guarantee to records you route through the SDK's logger. See Logging.

---

Protected Headers

Authorization, Accept, User-Agent, X-TypeSafe-SDK, and X-TypeSafe-Runtime are applied after default and per-call headers and cannot be displaced, whatever case they are written in. Header names are canonicalized before merging.

A caller-supplied X-TypeSafe-Retry-Count is stripped to prevent tampering with retry state.

---

URL Sanitization

Error endpoints and logged URLs are rendered as "METHOD URL" with userinfo, query parameters, and fragments removed, so credentials embedded in a URL never reach an error message or log line.

// https://user:secret@example.test/v1/models?token=x becomes:
// GET https://example.test/v1/models

---

No Redirects

The SDK's own HTTP client does not follow redirects. A redirected request would carry the API key to another host and could replay a POST body there, so a 3xx response surfaces as an *APIError instead. A client you supply via WithHTTPClient is used as-is, allowing deliberate redirect handling if required.

---

Bounded Payloads

Response bodies are read through a 16 MB limit (typesafe.MaxResponseBodyLimit) using io.LimitReader. An oversized payload is rejected with a clear error rather than causing an out-of-memory crash. Error messages include at most MaxErrorBodyLength (200) bytes of an unrecognized body.

For uploads, each image is capped at 16 MiB (MaxImageSizeLimit), and total request bodies are capped at 32 MiB (MaxRequestBodyLimit), failing with HTTP 413 *PayloadTooLargeError if exceeded.

---

Gzip Compression

Requests $\ge 1\text{ KiB}$ are compressed with standard gzip by default (WithCompression(true)), significantly reducing bandwidth for large tickets, documents, and image assets.

---

Strict Decoding

Missing fields, null where a value belongs, and wrong-typed fields in a success response are reported as errors naming the field (*APIResponseValidationError). Nothing is silently decoded into a zero value that could be mistaken for a real answer — a missing probability is an error, not 0.0. See Responses.

---

TLS

The SDK's own transport refuses TLS versions below 1.2, enables HTTP/2 when available, and pools connections with a 30-second dial timeout. A transport you supply is used as-is.

client, err := typesafe.NewClient(typesafe.WithTransport(myTransport))