🛡️ Sentinel: Fix JWT token leakage in error parameters

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2026-03-17 - Sensitive Token Leakage in Error Responses
+**Vulnerability:** The `INVALID_OR_EXPIRED_JWT_TOKEN` error was including the full JWT token in its `params`, which the global `errorHandler` then echoed back to the client.
+**Learning:** Even invalid or expired tokens can reveal sensitive information about the system's token structure or authentication mechanisms. Global error handlers that serialize all error parameters can unintentionally leak sensitive data.
+**Prevention:** Sanitize error parameters at the source or in the global error handler. Ensure that error parameter types in `activepieces-error.ts` do not include fields that might contain secrets or tokens.

packages/server/api/src/app/ee/connection-keys/connection-key.service.ts

@@ -46,9 +46,7 @@ export const connectionKeyService = (log: FastifyBaseLogger) => ({
         if (connectionName == null) {
             throw new ActivepiecesError({
                 code: ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
-                params: {
-                    token,
-                },
+                params: {},
             })
         }
         const connection = await appConnectionService(log).getOne({
@@ -74,9 +72,7 @@ export const connectionKeyService = (log: FastifyBaseLogger) => ({
         if (connectionName == null) {
             throw new ActivepiecesError({
                 code: ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
-                params: {
-                    token: request.token,
-                },
+                params: {},
             })
         }
 

packages/shared/src/lib/common/activepieces-error.ts

@@ -278,9 +278,7 @@ ErrorCode.FLOW_IN_USE,
 
 export type InvalidJwtTokenErrorParams = BaseErrorParams<
 ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
-{
-    token: string
-}
+Record<string, never>
 >
 
 export type TestTriggerFailedErrorParams = BaseErrorParams<