mirror of
https://github.com/0xMassi/webclaw.git
synced 2026-07-06 04:32:11 +02:00
clap prints the current value of an arg's `env` var in --help by default, which leaks secrets (e.g. `[env: WEBCLAW_API_KEY=wc_...]`) for anyone who has them set. Add `hide_env_values = true` to every arg backed by a credential-bearing env var so --help shows the variable name only. Covers the CLI (WEBCLAW_API_KEY, SERPER_API_KEY, WEBCLAW_PROXY, WEBCLAW_PROXY_FILE, WEBCLAW_WEBHOOK_URL, WEBCLAW_LLM_BASE_URL) and the server (WEBCLAW_API_KEY). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| webclaw-cli | ||
| webclaw-core | ||
| webclaw-fetch | ||
| webclaw-llm | ||
| webclaw-mcp | ||
| webclaw-pdf | ||
| webclaw-server | ||