GeezerVison

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 12, 2026 3:01am

PR Summary

High Risk
Changes security-critical credential redaction on public API surfaces that expose workflow graphs. Incorrect classification could either leak secrets or over-redact legitimate configuration.

Overview
Closes credential leaks in public workflow snapshots by fail-closed redaction of opaque and nested secret-bearing fields.

sanitizeWorkflowForSharing now supports redactOpaqueCredentialInputs, which nulls entire table values and walks nested tool-input params through the search-replace codecs. Only authoritative built-in tool params keep non-sensitive values; custom, MCP, unknown, and malformed params are withheld. Safe {{VAR}} references remain preserved.

This hardened projection is applied to v1/v2 execution logs and v2 workflow version reads, with OpenAPI/contract descriptions updated to match.

^{Reviewed by Cursor Bugbot for commit ff82280. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

The PR hardens public workflow snapshots by using shared tool-parameter codecs and withholding values whose safety cannot be authoritatively classified.

• Redacts credential-bearing tables, nested sensitive tool parameters, and malformed or unclassified tool values.
• Prevents custom and MCP tool IDs from resolving against colliding built-in registry definitions.
• Applies the hardened projection to public execution logs and workflow-version responses.
• Updates public API descriptions and focused sanitizer, indexer, log, and route tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (5): Last reviewed commit: "fix(security): isolate opaque tool schem..." | Re-trigger Greptile}

@greptile

@cursor review

@greptile

@cursor review

@greptile

@cursor review

@greptile

@cursor review