fix(proxy): remove unauthenticated _proxy_debug disclosure endpoint - #882
Merged
Conversation
/api/_proxy_debug answered any caller with a 10-char prefix of LANGSMITH_API_KEY, the upstream LangGraph deployment URL, and environment facts (hasDatabaseUrl, instanceId). It returned before the rate-limit and body-size gates, and the origin allowlist above it only rejects when an Origin header is present — so a plain curl reached it on both examples.threadplane.ai and demo.threadplane.ai. Nothing in CI, tests, or runbooks used it; the only references are historical plan docs. The path now proxies upstream like any other. Adds a regression test, mutation-verified to fail against the removed code. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
blove
enabled auto-merge (squash)
August 31, 2026 01:46
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/api/_proxy_debuganswered any unauthenticated caller on bothexamples.threadplane.aianddemo.threadplane.aiwith:apiKeyPrefix— the first 10 characters ofLANGSMITH_API_KEYbackendUrl/targetUrl— the upstream LangGraph Cloud deployment hostnamehasDatabaseUrl,rateLimitConfigured,instanceId, and the requestrefererVerified live on both domains before this change.
Why it was reachable. The branch returned before the rate-limit and body-size gates, and the origin allowlist above it only rejects when an
Originheader is present — a plaincurl(or any server-to-server call) skipped the 403 and fell through to a wildcard CORS header.Severity. Not a credential compromise:
lsv2_pt_is LangSmith's standard token prefix, so only two of the ten disclosed characters carry secret entropy — I don't think this alone warrants rotating the key. The more meaningful exposure is the upstream deployment URL, which bypasses this proxy's origin allowlist and rate limiting, plus confirmation of environment layout.Blast radius of removal. Nothing in CI, tests, or any runbook referenced it — the only mentions are historical plan docs from the original deploy work. The path now proxies upstream like any other (404s from the backend).
Adds a regression test that asserts the path is forwarded rather than short-circuited and that no proxy-authored response body carries the key or its prefix. Mutation-verified: it fails against the removed code and passes against this fix.
🤖 Generated with Claude Code