#1125 Treat the alert webhook URL as a secret Pull request opened by javuto Treat the alert webhook URL as a secret Problem Webhook URLs (Slack, Teams and similar hooks carry the token in the path) were returned in clear by the channel list API,

osctrl-cli alert channels

and the web edit form. A failed send also put the full URL in the error text, which reaches server logs and the test endpoint's 502 body. Change •

webhook

channel

SecretFields

is now

["url", "secret"]

and the

url

field is a secret type. List/get responses, the CLI and the edit form show

***

.

?reveal=1

and create/update responses still return the real value. • Saving with

***

(or empty) keeps the stored URL, because the merge runs before validation. The test endpoint with a channel id and

***

still delivers to the real URL. •

stripURLError

unwraps

*url.Error

in the send retry loop and in the URL parse error, so errors no longer contain the URL path or query. The host and port can still appear (for example

dial tcp 1.2.3.4:443

). •

ARCHITECTURE.md

and the OpenAPI types description mention that URLs and signing secrets are redacted.

osctrl-api.yaml

regenerated. • Frontend: test fixtures updated; the edit form shows the URL in a password input seeded with

***

. Security / operational impact • Reduces exposure of bearer-style webhook URLs to anyone with read access to channels, and to logs. • Compatibility: API clients that read a channel's

url

now get

***

unless they pass

?reveal=1

. No migration; stored values are unchanged. • On channel creation the URL is typed into a password input, so the pasted value is not visible. The test button still works. Validation •

go test ./pkg/... ./cmd/... -count=1

,

go vet ./...

,

gofmt

,

golangci-lint

,

make openapi-check

, frontend

npm test

and

npm run check

. • New tests:

pkg/alerts

redaction/merge/error-leak tests, update-preserves-secrets, test endpoint with stored URL, types endpoint, and the CLI list asserting the URL never appears in either mode. • Go tests were seen failing before the change. The new frontend test passed without a component change. jmpsec/osctrl