🛡️ Sentinel: Fix sensitive data leakage in error responses

[AGI-Corporation]

🚨 Severity: HIGH

💡 Vulnerability: Sensitive Data Leakage in Error Responses

🎯 Impact: JWT tokens and License Keys were being included in the params of ActivepiecesError, which the global backend error handler serializes directly into API responses. This could lead to credential exposure in logs or to unauthorized parties.

🔧 Fix:

• Updated InvalidJwtTokenErrorParams and InvalidLicenseKeyParams in packages/shared/src/lib/common/activepieces-error.ts to exclude sensitive fields.
• Updated calls to ActivepiecesError in connection-key.service.ts and license-keys-controller.ts to remove the sensitive values from parameters.

✅ Verification:

• Verified that npx eslint passes for the modified files.
• Confirmed with read_file that the changes were correctly applied.
• Ensured no unwanted pnpm-lock.yaml file is included in the PR.

---

PR created automatically by Jules for task 7009615417473966508 started by @AGI-Corporation

Summary by CodeRabbit

• Bug Fixes

  • Error responses no longer include sensitive authentication tokens or license keys in error details.
  • Redirect flow now targets a specific origin (instead of a wildcard) and fixes a success message typo.

• Documentation

  • Added guidance documenting the sensitive-data-in-errors issue and prevention recommendations.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR removes sensitive JWT tokens and license keys from error payloads by changing error param types to empty records and updating places that populated errors to emit empty params objects; also adds documentation and tweaks redirect origin resolution.

Changes

Cohort / File(s)	Summary
Documentation .jules/sentinel.md	Added sentinel entry documenting a sensitive-data leakage in error params and guidance to avoid sensitive fields in error parameter types.
Shared error types packages/shared/src/lib/common/activepieces-error.ts	Changed InvalidJwtTokenErrorParams and InvalidLicenseKeyParams to Record<string, never> (removed { token } and { key } fields).
Server: error emission packages/server/api/src/app/ee/connection-keys/connection-key.service.ts, packages/server/api/src/app/ee/license-keys/license-keys-controller.ts	Replaced error params that previously included JWT token or licenseKey values with empty params: {} when throwing ActivepiecesError.
Server: redirect origin packages/server/api/src/app/app.ts	Added platformUtils usage to derive platformId and compute targetOrigin via domainHelper.getPublicUrl({ platformId }); fixed a typo in the success message.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I sniffed the logs and hopped with care,

no token crumbs left in the air.
Empty pockets, secrets kept,
A tidy trail where leeks once leapt.
Hooray — no keys for foxes to share! 🥕✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing sensitive data leakage in error responses, which matches the primary objective of removing JWT tokens and license keys from error parameters.
Description check	✅ Passed	The description clearly explains what the PR does, the vulnerability being fixed, the implementation details, and verification steps, but does not follow the provided template structure with 'What does this PR do?' and 'Explain How the Feature Works' sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sensitive-data-leakage-in-errors-7009615417473966508

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.jules/sentinel.md:
- Line 1: Update the incident note header that currently reads "## 2025-03-19 -
Sensitive Data Leakage in Error Parameters" to the correct PR date (replace
2025-03-19 with 2026-03-19) so the sentinel entry's timestamp matches the change
set; ensure the header text "Sensitive Data Leakage in Error Parameters" remains
unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 593c2d8e-4450-4f67-8624-ebf0f357e817

📥 Commits

Reviewing files that changed from the base of the PR and between f61e720 and ddf0875.

📒 Files selected for processing (4)

• .jules/sentinel.md
• packages/server/api/src/app/ee/connection-keys/connection-key.service.ts
• packages/server/api/src/app/ee/license-keys/license-keys-controller.ts
• packages/shared/src/lib/common/activepieces-error.ts

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Fix the incident note date to match this PR timeline.

Line 1 says 2025-03-19, but this change set is from March 19, 2026. Keeping the exact date accurate matters for security audit trails.

📝 Suggested patch

-## 2025-03-19 - Sensitive Data Leakage in Error Parameters
+## 2026-03-19 - Sensitive Data Leakage in Error Parameters

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	## 2025-03-19 - Sensitive Data Leakage in Error Parameters
	## 2026-03-19 - Sensitive Data Leakage in Error Parameters

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.jules/sentinel.md at line 1, Update the incident note header that currently
reads "## 2025-03-19 - Sensitive Data Leakage in Error Parameters" to the
correct PR date (replace 2025-03-19 with 2026-03-19) so the sentinel entry's
timestamp matches the change set; ensure the header text "Sensitive Data Leakage
in Error Parameters" remains unchanged.

[coderabbitai]

🧹 Nitpick comments (1)

packages/server/api/src/app/app.ts (1)

254-255: Guard origin resolution to avoid 500s in redirect flow.
Line 254 and Line 255 can throw (platform lookup / URL parsing). In that case, /redirect fails hard instead of returning a controlled response.

Proposed hardening

-                const platformId = await platformUtils.getPlatformIdForRequest(request)
-                const targetOrigin = new URL(await domainHelper.getPublicUrl({ platformId })).origin
-                return reply
-                    .type('text/html')
-                    .send(
-                        `<script>if(window.opener){window.opener.postMessage({ 'code': '${encodeURIComponent(
-                            params.code,
-                        )}' }, '${targetOrigin}')}</script> <html>Redirect successfully, this window should close now</html>`,
-                    )
+                try {
+                    const platformId = await platformUtils.getPlatformIdForRequest(request)
+                    const publicUrl = await domainHelper.getPublicUrl({ platformId })
+                    const targetOrigin = new URL(publicUrl).origin
+                    return reply
+                        .type('text/html')
+                        .send(
+                            `<script>if(window.opener){window.opener.postMessage({ 'code': '${encodeURIComponent(
+                                params.code,
+                            )}' }, '${targetOrigin}')}</script> <html>Redirect successfully, this window should close now</html>`,
+                        )
+                }
+                catch (error) {
+                    request.log.warn({ error }, 'Failed to resolve redirect target origin')
+                    return reply.code(400).send('Unable to resolve redirect origin')
+                }

Also applies to: 261-261

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/server/api/src/app/app.ts` around lines 254 - 255, The platform
lookup and URL parsing calls (platformUtils.getPlatformIdForRequest and
domainHelper.getPublicUrl, used to compute targetOrigin) can throw and currently
cause a 500 in the /redirect flow; wrap the platformId retrieval and URL parsing
in a try/catch, log the error, and return a controlled response from the
redirect handler (e.g., a safe redirect or a 4xx/302 fallback) instead of
allowing the exception to propagate; apply the same guard around the later usage
at the block referencing the same domainHelper.getPublicUrl call (the code
around line 261) so targetOrigin resolution failures are consistently handled.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@packages/server/api/src/app/app.ts`:
- Around line 254-255: The platform lookup and URL parsing calls
(platformUtils.getPlatformIdForRequest and domainHelper.getPublicUrl, used to
compute targetOrigin) can throw and currently cause a 500 in the /redirect flow;
wrap the platformId retrieval and URL parsing in a try/catch, log the error, and
return a controlled response from the redirect handler (e.g., a safe redirect or
a 4xx/302 fallback) instead of allowing the exception to propagate; apply the
same guard around the later usage at the block referencing the same
domainHelper.getPublicUrl call (the code around line 261) so targetOrigin
resolution failures are consistently handled.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bdc16a0b-046f-4a05-b2d7-56d145db4948

📥 Commits

Reviewing files that changed from the base of the PR and between ddf0875 and b058d36.

📒 Files selected for processing (1)

• packages/server/api/src/app/app.ts