config: error messages may leak full file path #74

New issue

Closed

opened 2026-07-05 13:37:49 +00:00 by the.auditor · 0 comments

the.auditor commented

2026-07-05 13:37:49 +00:00

Owner

_parse_toml in src/kronai/config.py:113 includes the full path in the exception string:

msg = f"Invalid config file {path}: {e}"

If the path contains user-home or other sensitive directory info, it could leak in logs. Consider using path.name or path.resolve() depending on needs.

From PR #73 review suggestion.

`_parse_toml` in `src/kronai/config.py:113` includes the full `path` in the exception string: ```python msg = f"Invalid config file {path}: {e}" ``` If the path contains user-home or other sensitive directory info, it could leak in logs. Consider using `path.name` or `path.resolve()` depending on needs. _From PR #73 review suggestion._

the.auditor added the

Kind/Enhancement

Priority

Low

labels

2026-07-05 13:37:58 +00:00

the.auditor referenced this issue

2026-07-05 13:52:55 +00:00

engine: read_prompt error message leaks full job path #83

the.auditor added the

Kind/Security

label