From 32711ee2f8b640960bd124e4be7bdccc28834a6c Mon Sep 17 00:00:00 2001 From: VforVitorio Date: Sun, 18 Oct 2026 18:32:52 +0200 Subject: [PATCH 1/2] ci(security): report OSV baseline findings without failing main --- .github/workflows/osv-scanner.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 226f609..b65fc8a 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -17,7 +17,12 @@ jobs: scan-scheduled: if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0 + with: + # Upload the full baseline; the pull-request scan gates newly introduced findings. + fail-on-vuln: false scan-pr: if: ${{ github.event_name == 'pull_request' }} uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0 + with: + fail-on-vuln: true From 0654aafeb7e39ad35d4498f2421f93e5afcef346 Mon Sep 17 00:00:00 2001 From: VforVitorio Date: Sun, 18 Oct 2026 18:34:37 +0200 Subject: [PATCH 2/2] fix(security): scope FastMCP traceback redaction to tools --- backend/core/mcp_audit.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/core/mcp_audit.py b/backend/core/mcp_audit.py index b540e43..87fd2fd 100644 --- a/backend/core/mcp_audit.py +++ b/backend/core/mcp_audit.py @@ -20,8 +20,9 @@ class _ToolFailureTracebackFilter(logging.Filter): """Keep FastMCP's generic tool-error line but not exception payloads/arguments.""" def filter(self, record: logging.LogRecord) -> bool: - record.exc_info = None - record.exc_text = None + if record.getMessage().startswith(("Error calling tool", "Error validating tool")): + record.exc_info = None + record.exc_text = None return True