Scrub API key from Sentry crash reports

The 'headers' local in codeplain_REST_api.post_request holds the raw
API key (X-API-Key) and was serialized into stack trace frame vars.
Add 'headers' and the hyphenated 'x-api-key' to the scrub denylist
(the SDK default only covers the underscore form) and enable recursive
scrubbing so sensitive keys nested inside dict locals are filtered too.

Users remain identifiable via the existing render_id tag, which the
backend can map to an account since every render API call sends the
render_id on an authenticated request.

Author: hisenb3rg

plain2code_telemetry.py

@@ -29,8 +29,13 @@
 # Local variable names whose values may contain proprietary spec or generated
 # code content and must be scrubbed from stack traces (extends Sentry's
 # default denylist, which already covers api_key, auth, secrets etc.).
+# "headers" and "x-api-key" cover the request headers local in
+# codeplain_REST_api.post_request; the default denylist only has the
+# underscore form "x_api_key".
 SCRUB_DENYLIST = DEFAULT_DENYLIST + [
     "authorization",
+    "headers",
+    "x-api-key",
     "plain_source",
     "plain_source_tree",
     "full_plain_source",
@@ -71,7 +76,7 @@ def initialize_telemetry(**init_overrides: Any) -> bool:
                 ModulesIntegration(),
             ],
             include_local_variables=True,
-            event_scrubber=EventScrubber(denylist=SCRUB_DENYLIST),
+            event_scrubber=EventScrubber(denylist=SCRUB_DENYLIST, recursive=True),
             shutdown_timeout=FLUSH_TIMEOUT_SECONDS,
         )
         init_kwargs.update(init_overrides)

tests/test_telemetry.py

@@ -1,3 +1,4 @@
+import json
 import sys
 from argparse import Namespace
 
@@ -8,12 +9,7 @@
 
 import plain2code_telemetry
 from plain2code_state import RunState
-from plain2code_telemetry import (
-    NO_TELEMETRY_ENV_VAR,
-    capture_crash,
-    initialize_telemetry,
-    telemetry_enabled,
-)
+from plain2code_telemetry import NO_TELEMETRY_ENV_VAR, capture_crash, initialize_telemetry, telemetry_enabled
 
 
 class CaptureTransport(Transport):
@@ -132,6 +128,55 @@ def crash_with_sensitive_locals():
     assert crash_frame_vars["plain_source"] == "[Filtered]"
 
 
+def test_request_headers_local_is_scrubbed(transport):
+    """The `headers` local in codeplain_REST_api.post_request holds the API key
+    (X-API-Key); the whole variable must be filtered from stack traces."""
+    init_with_transport(transport)
+
+    # Built at runtime so the secret never appears in the source-context lines
+    # that Sentry attaches to stack frames.
+    secret = "".join(["super", "-secret-", "key"])
+
+    def crash_with_headers_local():
+        headers = {"X-API-Key": secret, "Content-Type": "application/json"}  # noqa: F841
+        raise KeyError("boom")
+
+    try:
+        crash_with_headers_local()
+    except KeyError:
+        exc_info = sys.exc_info()
+
+    assert capture_crash(exc_info, None, make_args())
+    sentry_sdk.flush(timeout=2)
+
+    frames = transport.events[0]["exception"]["values"][0]["stacktrace"]["frames"]
+    crash_frame_vars = frames[-1]["vars"]
+    assert crash_frame_vars["headers"] == "[Filtered]"
+    assert secret not in json.dumps(transport.events[0], default=str)
+
+
+def test_nested_sensitive_keys_are_scrubbed(transport):
+    """Scrubbing is recursive: sensitive keys nested inside dict locals are
+    filtered even when the variable name itself is innocuous."""
+    init_with_transport(transport)
+
+    secret = "".join(["nested", "-secret-", "key"])
+
+    def crash_with_nested_secret():
+        request_info = {"url": "https://api.codeplain.ai", "x-api-key": secret}  # noqa: F841
+        raise KeyError("boom")
+
+    try:
+        crash_with_nested_secret()
+    except KeyError:
+        exc_info = sys.exc_info()
+
+    assert capture_crash(exc_info, None, make_args())
+    sentry_sdk.flush(timeout=2)
+
+    assert secret not in json.dumps(transport.events[0], default=str)
+
+
 def test_environment_defaults_to_production(transport):
     init_with_transport(transport)
     assert sentry_sdk.get_client().options["environment"] == "production"