clawbot
9ae19159a3
Some checks failed
check / check (push) Superseded by a newer commit; never tested
The http target's destination URL can itself be a bearer credential, and the source detail page rendered it in full. Render it through the existing MaskURL instead, matching the rule already applied to slack targets. Independently reviewed: mutation-verified (reverting to the raw value fails the absence assertions, not merely the masked-form ones), MaskURL probed against userinfo, query, fragment, port, IPv6 literal and non-http schemes, and every sibling path that surfaces target data re-walked and found clean.