{"repo":"NousResearch/hermes-agent","public_id":"126129","display_label":"Debug share credential redaction and hardening","summary":"A bug was identified where debug share uploads and the gateway /debug endpoint exposed sensitive credentials—including API keys, URL tokens, and passwords—unredacted. Multiple fixes address masking and hardening redaction at various points in the debug data pipeline.","subsystem":null,"counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":2,"attempt_prs":3},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":127207},"resolution":{"state":"resolved","by":"pr-127207"},"freshness":{"state":"verified","last_verified_at":"2026-09-29T11:51:45+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.3333333333333333},"fix_edges":[{"issue_number":126129,"pr_number":127207,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":126129,"pr_number":127749,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false}],"members":[{"kind":"issue","number":126129,"title":"[Bug]: debug share and gateway /debug include fallback_providers API keys from the dump unredacted","url":null,"state":"closed"},{"kind":"pr","number":126132,"title":"fix(debug): redact the system dump in debug share and gateway /debug","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#127207","number":127207},{"kind":"pr","value":"#127207","number":127207}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":126168,"title":"fix(debug): harden dump redaction at upload boundary","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#127207","number":127207},{"kind":"pr","value":"#127207","number":127207}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":127207,"title":"fix(debug): redact fallback provider credentials in hermes dump, debug share and /debug","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/redact.py","hermes_cli/debug.py","hermes_cli/dump.py","tests/hermes_cli/test_debug.py","website/docs/reference/cli-commands.md","website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/reference/cli-commands.md"]},{"kind":"pr","number":127426,"title":"fix(debug): mask URL tokens and passwords in debug share uploads","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#127749","number":127749},{"kind":"pr","value":"#127207","number":127207},{"kind":"pr","value":"#126129","number":126129},{"kind":"pr","value":"#127207","number":127207}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":127749,"title":"fix(debug): mask URL tokens and passwords in debug share uploads","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/debug.py","tests/hermes_cli/test_debug.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}