V1 [SEC] Passwords exposed in statement summary ring buffer

[austin-barrington]

Bug

The statement summary feature (statement_summary.enabled = true by default) stores the full query text in a ring buffer exposed at GET /api/v1/statements. When users issue CREATE USER "foo" WITH PASSWORD 'secret', the password is stored in plaintext in the ring buffer.

Additionally, the statement summary endpoint (GET /api/v1/statements) is unauthenticated even when [auth] enabled = true (see separate ticket).

Deliverables

• Redact PASSWORD '<password>' from CREATE USER and SET PASSWORD FOR statements before storing in the statement summary ring buffer. Replace password value with PASSWORD '****'.
• Similarly redact credentials in u/p query parameters, Authorization headers, and any other credential-bearing inputs that might appear in logged query text.
• Verify that the redacted text is what gets stored in the ring buffer and emitted in logs.

References

• docs/user-guide/authentication.md:33 — statement summary is public
• Statement summary implementation in src/application/

Priority

P1 — Security, credential leakage

[austin-barrington]

Fixed: redact_credentials() in digest.rs:52-79 replaces PASSWORD literals and query params with ****. Applied before statement summary recording (query.rs:240-241). Integration test verifies.