fix(security): redact API header table diagnostics

[BillLeoutsakosvl346]

Summary

• Redact sensitive API header values in diagnostic copies of header tables and maps, including Cookie and Set-Cookie.
• Preserve ordinary headers, row structure, saved inputs, outbound requests and downstream execution values. Keep unrelated tables unchanged.

Type of Change

• Bug fix

Testing

• 171 tests passed across redaction, block execution and HTTP requests. New regressions exercise diagnostic projection with both table and stringified inputs while preserving execution data.
• App type-check, repository lint, all 46 audits, block registry and docs-manifest checks passed; required artifact generators produced no changes.
• No live credentials or external requests used; this is execution-boundary verification, not browser testing.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 9, 2026 8:23pm UTC

[greptile-apps]

Greptile Summary

This PR strengthens diagnostic redaction for HTTP headers while preserving execution-time data.

• Recognizes sensitive header names case-insensitively, including Cookie and Set-Cookie.
• Supports canonical header maps and table-row representations.
• Adds focused redaction tests and executor-level coverage for parsed and stringified table inputs.
• Leaves saved block configuration, handler inputs, execution state, and ordinary headers unchanged.

Confidence Score: 5/5

The PR appears safe to merge; the changed diagnostic projection redacts supported sensitive header representations without affecting execution values.

No actionable failures remain: canonical header maps and table rows are redacted, ordinary headers are preserved, and executor-level coverage confirms that saved inputs and downstream state remain unchanged.

Important Files Changed

Filename	Overview
apps/sim/lib/core/security/redaction.ts	Adds non-mutating, case-insensitive redaction for sensitive HTTP-header maps and canonical table rows.
apps/sim/lib/core/security/redaction.test.ts	Covers sensitive header variants, map and table representations, idempotence, source preservation, and unrelated-table behavior.
apps/sim/executor/execution/block-executor.test.ts	Verifies that diagnostic inputs are redacted without changing handler inputs, block configuration, or execution output.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Config[Saved API header configuration] --> Executor[Block executor]
  Executor --> Runtime[Handler and downstream execution]
  Executor --> Projection[Diagnostic projection]
  Projection --> Redaction[Header-aware redaction]
  Redaction --> Logs[Block logs and completion callback]
  Runtime --> State[Execution state]

Loading

_{Reviews (1): Last reviewed commit: "fix(security): redact API header table d..." | Re-trigger Greptile}

[BillLeoutsakosvl346]

Screenshot — synthetic component preview

This passes synthetic header-table data through this PR’s redaction function and displays it in the same Code.Viewer used in execution details. Authorization and Cookie are masked; Accept stays visible. This is not a live workflow or full-app end-to-end screenshot.