Files
zeroclaw/src/gateway
fettpl e6ad48df48 fix(security): stop leaking serde parse details in gateway error responses
Replace the dynamic error message in the webhook JSON parsing error
path with a static message. Previously, the raw JsonRejection error
from axum/serde was interpolated into the HTTP response, potentially
exposing internal parsing details to unauthenticated callers.

The detailed error is now logged server-side via tracing::warn for
debugging, while the client receives a generic "Invalid JSON body"
message.

Closes #356

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 17:27:07 +01:00
..