From 4a6ef580f4c81294f41bd32afe21b2719c5930af Mon Sep 17 00:00:00 2001
From: Open <open@OpendeMac-mini.lan>
Date: Mon, 1 Jun 2026 04:59:38 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=BC=82=E5=B8=B8=20security?=
 =?UTF-8?q?=20=E9=85=8D=E7=BD=AE=E5=AF=BC=E8=87=B4=E6=8E=A5=E5=8F=A3?=
 =?UTF-8?q?=E5=B4=A9=E6=BA=83=20(#88)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app.py                    | 11 +++++++++--
 tests/test_vibe_status.py | 10 ++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/app.py b/app.py
index 57d6aa7..fb4b3e4 100644
--- a/app.py
+++ b/app.py
@@ -412,13 +412,20 @@ def settings_config_from_params(params: Dict[str, list], base_config: Dict[str,
 
 def configured_api_token() -> str:
     """Return the optional API write token."""
-    return str(config.get("security", {}).get("api_token", "")).strip()
+    security = config.get("security", {})
+    if not isinstance(security, dict):
+        return ""
+    return str(security.get("api_token", "")).strip()
 
 
 def public_config() -> Dict[str, Any]:
     """Return configuration safe to expose through the read-only config API."""
     safe_config = copy.deepcopy(config)
-    token = str(safe_config.get("security", {}).get("api_token", "")).strip()
+    security = safe_config.get("security", {})
+    if not isinstance(security, dict):
+        safe_config["security"] = {}
+        return safe_config
+    token = str(security.get("api_token", "")).strip()
     if token:
         safe_config.setdefault("security", {})["api_token"] = "<configured>"
     return safe_config
diff --git a/tests/test_vibe_status.py b/tests/test_vibe_status.py
index df740c1..5a05cc0 100644
--- a/tests/test_vibe_status.py
+++ b/tests/test_vibe_status.py
@@ -551,6 +551,16 @@ def test_public_config_redacts_configured_api_token(self):
         self.assertEqual(safe["security"]["api_token"], "<configured>")
         self.assertEqual(app.config, original_config)
 
+    def test_security_helpers_tolerate_invalid_security_section(self):
+        original_config = app.config
+        try:
+            app.config = {"security": "not-an-object"}
+
+            self.assertEqual(app.configured_api_token(), "")
+            self.assertEqual(app.public_config()["security"], {})
+        finally:
+            app.config = original_config
+
     def test_compute_local_token_usage_sums_recent_last_usage(self):
         codex_home = Path(self.tmpdir.name) / ".codex"
         session_dir = codex_home / "sessions" / "2026" / "05"