Skip to content

fix: redact sensitive info in logs and fix strict type violations#70

Merged
nicknisi merged 5 commits intoworkos:mainfrom
Rayhan1967:fix/critical-security-and-types
Feb 24, 2026
Merged

fix: redact sensitive info in logs and fix strict type violations#70
nicknisi merged 5 commits intoworkos:mainfrom
Rayhan1967:fix/critical-security-and-types

Conversation

@Rayhan1967
Copy link
Contributor

Summary

This PR addresses two critical issues identified in the codebase:

  1. Security: Redacts sensitive information (API keys and client IDs) from installation error logs to prevent potential leakage in plaintext files.
  2. Code Quality: Removes forbidden as any and as unknown usage, replacing them with proper TypeScript interfaces and type-only imports to adhere to the project's strict typing standards.

Changes

  • Modified src/utils/clack-utils.ts to include a redactSensitiveInfo utility.
  • Applied redaction in src/utils/clack-utils.ts's installPackage function.
  • Updated src/bin.ts and src/commands/install.ts to use proper types instead of as any.
  • Exported InstallArgs for proper type-safety in the CLI entry point.

rayhan1967 and others added 5 commits February 22, 2026 00:07
- Replace `as ArgumentsCamelCase<InstallArgs>` with argv spread in bin.ts
- Use identity builder for env list command to inherit parent options
- Remove dead `if (!str)` guard in redactSensitiveInfo
- Consolidate duplicate InstallerArgs type into single export from run.ts
- Tighten client ID redaction regex to avoid false positives
@nicknisi
Copy link
Member

@Rayhan1967 Thanks for this! I made a few minor changes, mostly around formatting to appease CI. I appreciate it!

@nicknisi nicknisi merged commit 707193b into workos:main Feb 24, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants