Files
gbrain/test
bb3376e3b0 fix(security): prevent leaking admin bootstrap token to non-TTY stdout (#2625)
* fix(security): #2624 don't print admin bootstrap token on non-TTY (log-leak)

serve --http printed the generated admin token in the startup banner
unconditionally. In containerized deploys stderr ships to centralized log
storage, turning the token into a standing secret in logs.

Fail-safe default: the generated token now prints only when stderr is an
interactive TTY. Non-TTY starts hide it (--print-admin-token forces it;
$GBRAIN_ADMIN_BOOTSTRAP_TOKEN + --suppress-bootstrap-token already existed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(security): #2624 banner shows 'from env' before non-TTY hidden guard

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 13:34:28 -07:00
..