From 81a3bb0f0769e5a765e77649d002ea6acf9a667f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 11 May 2026 21:18:07 +0200
Subject: [PATCH] fix(api): hide sensitive fields by default

Add model-level hidden fields for secrets, tokens, keys, notification
credentials, deployment logs, and environment values. Allow explicit
read:sensitive API access to reveal gated private keys and deployment logs,
and cover the behavior with feature and unit tests.
---
 app/Http/Controllers/Api/DeployController.php |   7 +
 .../Controllers/Api/SecurityController.php    |   4 +
 app/Models/ApplicationDeploymentQueue.php     |   4 +
 app/Models/CloudInitScript.php                |   4 +
 app/Models/CloudProviderToken.php             |   4 +
 app/Models/DiscordNotificationSettings.php    |   4 +
 app/Models/EmailNotificationSettings.php      |  10 ++
 app/Models/InstanceSettings.php               |  11 ++
 app/Models/OauthSetting.php                   |   4 +
 app/Models/PrivateKey.php                     |   4 +
 app/Models/PushoverNotificationSettings.php   |   5 +
 app/Models/S3Storage.php                      |   5 +
 app/Models/SharedEnvironmentVariable.php      |   4 +
 app/Models/SlackNotificationSettings.php      |   4 +
 app/Models/SslCertificate.php                 |   4 +
 app/Models/TelegramNotificationSettings.php   |  22 ++-
 app/Models/WebhookNotificationSettings.php    |   4 +
 .../components/notification/navbar.blade.php  |   2 +-
 .../Security/ApiSensitiveFieldsTest.php       |  95 ++++++++++++
 .../Unit/Models/SensitiveFieldsHiddenTest.php | 136 ++++++++++++++++++
 20 files changed, 335 insertions(+), 2 deletions(-)

diff --git a/app/Http/Controllers/Api/DeployController.php b/app/Http/Controllers/Api/DeployController.php
index c93731d68..7a049ae2b 100644
--- a/app/Http/Controllers/Api/DeployController.php
+++ b/app/Http/Controllers/Api/DeployController.php
@@ -25,6 +25,10 @@ private function removeSensitiveData($deployment)
             $deployment->makeHidden([
                 'logs',
             ]);
+        } else {
+            $deployment->makeVisible([
+                'logs',
+            ]);
         }
 
         return serializeApiResponse($deployment);
@@ -699,6 +703,9 @@ public function get_application_deployments(Request $request)
         $this->authorize('view', $application);
 
         $deployments = $application->deployments($skip, $take);
+        if ($request->attributes->get('can_read_sensitive', false) === true) {
+            $deployments['deployments']->each->makeVisible(['logs']);
+        }
 
         return response()->json($deployments);
     }
diff --git a/app/Http/Controllers/Api/SecurityController.php b/app/Http/Controllers/Api/SecurityController.php
index e59c40866..759af5134 100644
--- a/app/Http/Controllers/Api/SecurityController.php
+++ b/app/Http/Controllers/Api/SecurityController.php
@@ -16,6 +16,10 @@ private function removeSensitiveData($team)
             $team->makeHidden([
                 'private_key',
             ]);
+        } else {
+            $team->makeVisible([
+                'private_key',
+            ]);
         }
 
         return serializeApiResponse($team);
diff --git a/app/Models/ApplicationDeploymentQueue.php b/app/Models/ApplicationDeploymentQueue.php
index 67f28523c..f4c334bf3 100644
--- a/app/Models/ApplicationDeploymentQueue.php
+++ b/app/Models/ApplicationDeploymentQueue.php
@@ -68,6 +68,10 @@ class ApplicationDeploymentQueue extends Model
         'finished_at',
     ];
 
+    protected $hidden = [
+        'logs',
+    ];
+
     protected $casts = [
         'pull_request_id' => 'integer',
         'finished_at' => 'datetime',
diff --git a/app/Models/CloudInitScript.php b/app/Models/CloudInitScript.php
index 2c78cc582..9d2676aca 100644
--- a/app/Models/CloudInitScript.php
+++ b/app/Models/CloudInitScript.php
@@ -12,6 +12,10 @@ class CloudInitScript extends Model
         'script',
     ];
 
+    protected $hidden = [
+        'script',
+    ];
+
     protected function casts(): array
     {
         return [
diff --git a/app/Models/CloudProviderToken.php b/app/Models/CloudProviderToken.php
index 026d11fba..02c662d9d 100644
--- a/app/Models/CloudProviderToken.php
+++ b/app/Models/CloudProviderToken.php
@@ -11,6 +11,10 @@ class CloudProviderToken extends BaseModel
         'name',
     ];
 
+    protected $hidden = [
+        'token',
+    ];
+
     protected $casts = [
         'token' => 'encrypted',
     ];
diff --git a/app/Models/DiscordNotificationSettings.php b/app/Models/DiscordNotificationSettings.php
index e86598126..135c921f6 100644
--- a/app/Models/DiscordNotificationSettings.php
+++ b/app/Models/DiscordNotificationSettings.php
@@ -34,6 +34,10 @@ class DiscordNotificationSettings extends Model
         'discord_ping_enabled',
     ];
 
+    protected $hidden = [
+        'discord_webhook_url',
+    ];
+
     protected $casts = [
         'discord_enabled' => 'boolean',
         'discord_webhook_url' => 'encrypted',
diff --git a/app/Models/EmailNotificationSettings.php b/app/Models/EmailNotificationSettings.php
index 1277e45d9..7368bafbf 100644
--- a/app/Models/EmailNotificationSettings.php
+++ b/app/Models/EmailNotificationSettings.php
@@ -43,6 +43,16 @@ class EmailNotificationSettings extends Model
         'traefik_outdated_email_notifications',
     ];
 
+    protected $hidden = [
+        'smtp_from_address',
+        'smtp_from_name',
+        'smtp_recipients',
+        'smtp_host',
+        'smtp_username',
+        'smtp_password',
+        'resend_api_key',
+    ];
+
     protected $casts = [
         'smtp_enabled' => 'boolean',
         'smtp_from_address' => 'encrypted',
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index d5c3bfa28..d63611fac 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -48,6 +48,17 @@ class InstanceSettings extends Model
         'is_mcp_server_enabled',
     ];
 
+    protected $hidden = [
+        'smtp_from_address',
+        'smtp_from_name',
+        'smtp_recipients',
+        'smtp_host',
+        'smtp_username',
+        'smtp_password',
+        'resend_api_key',
+        'sentinel_token',
+    ];
+
     protected $casts = [
         'smtp_enabled' => 'boolean',
         'smtp_from_address' => 'encrypted',
diff --git a/app/Models/OauthSetting.php b/app/Models/OauthSetting.php
index 08e08d85b..e7999134a 100644
--- a/app/Models/OauthSetting.php
+++ b/app/Models/OauthSetting.php
@@ -13,6 +13,10 @@ class OauthSetting extends Model
 
     protected $fillable = ['provider', 'client_id', 'client_secret', 'redirect_uri', 'tenant', 'base_url', 'enabled'];
 
+    protected $hidden = [
+        'client_secret',
+    ];
+
     protected function clientSecret(): Attribute
     {
         return Attribute::make(
diff --git a/app/Models/PrivateKey.php b/app/Models/PrivateKey.php
index 1521678f3..ee330aa19 100644
--- a/app/Models/PrivateKey.php
+++ b/app/Models/PrivateKey.php
@@ -41,6 +41,10 @@ class PrivateKey extends BaseModel
         'fingerprint',
     ];
 
+    protected $hidden = [
+        'private_key',
+    ];
+
     protected $casts = [
         'private_key' => 'encrypted',
     ];
diff --git a/app/Models/PushoverNotificationSettings.php b/app/Models/PushoverNotificationSettings.php
index 5ad617ad6..dd0d81cc0 100644
--- a/app/Models/PushoverNotificationSettings.php
+++ b/app/Models/PushoverNotificationSettings.php
@@ -34,6 +34,11 @@ class PushoverNotificationSettings extends Model
         'traefik_outdated_pushover_notifications',
     ];
 
+    protected $hidden = [
+        'pushover_user_key',
+        'pushover_api_token',
+    ];
+
     protected $casts = [
         'pushover_enabled' => 'boolean',
         'pushover_user_key' => 'encrypted',
diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index 3f6ee51cc..dbc895825 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -26,6 +26,11 @@ class S3Storage extends BaseModel
         'unusable_email_sent',
     ];
 
+    protected $hidden = [
+        'key',
+        'secret',
+    ];
+
     protected $casts = [
         'is_usable' => 'boolean',
         'key' => 'encrypted',
diff --git a/app/Models/SharedEnvironmentVariable.php b/app/Models/SharedEnvironmentVariable.php
index eadc33ec2..8bb241240 100644
--- a/app/Models/SharedEnvironmentVariable.php
+++ b/app/Models/SharedEnvironmentVariable.php
@@ -30,6 +30,10 @@ class SharedEnvironmentVariable extends Model
         'version',
     ];
 
+    protected $hidden = [
+        'value',
+    ];
+
     protected $casts = [
         'key' => 'string',
         'value' => 'encrypted',
diff --git a/app/Models/SlackNotificationSettings.php b/app/Models/SlackNotificationSettings.php
index d4f125fb5..62603685e 100644
--- a/app/Models/SlackNotificationSettings.php
+++ b/app/Models/SlackNotificationSettings.php
@@ -33,6 +33,10 @@ class SlackNotificationSettings extends Model
         'traefik_outdated_slack_notifications',
     ];
 
+    protected $hidden = [
+        'slack_webhook_url',
+    ];
+
     protected $casts = [
         'slack_enabled' => 'boolean',
         'slack_webhook_url' => 'encrypted',
diff --git a/app/Models/SslCertificate.php b/app/Models/SslCertificate.php
index eb2175d44..2311cea72 100644
--- a/app/Models/SslCertificate.php
+++ b/app/Models/SslCertificate.php
@@ -20,6 +20,10 @@ class SslCertificate extends Model
         'is_ca_certificate',
     ];
 
+    protected $hidden = [
+        'ssl_private_key',
+    ];
+
     protected $casts = [
         'ssl_certificate' => 'encrypted',
         'ssl_private_key' => 'encrypted',
diff --git a/app/Models/TelegramNotificationSettings.php b/app/Models/TelegramNotificationSettings.php
index 4930f45d4..8c644f9bc 100644
--- a/app/Models/TelegramNotificationSettings.php
+++ b/app/Models/TelegramNotificationSettings.php
@@ -49,6 +49,25 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_traefik_outdated_thread_id',
     ];
 
+    protected $hidden = [
+        'telegram_token',
+        'telegram_chat_id',
+        'telegram_notifications_deployment_success_thread_id',
+        'telegram_notifications_deployment_failure_thread_id',
+        'telegram_notifications_status_change_thread_id',
+        'telegram_notifications_backup_success_thread_id',
+        'telegram_notifications_backup_failure_thread_id',
+        'telegram_notifications_scheduled_task_success_thread_id',
+        'telegram_notifications_scheduled_task_failure_thread_id',
+        'telegram_notifications_docker_cleanup_success_thread_id',
+        'telegram_notifications_docker_cleanup_failure_thread_id',
+        'telegram_notifications_server_disk_usage_thread_id',
+        'telegram_notifications_server_reachable_thread_id',
+        'telegram_notifications_server_unreachable_thread_id',
+        'telegram_notifications_server_patch_thread_id',
+        'telegram_notifications_traefik_outdated_thread_id',
+    ];
+
     protected $casts = [
         'telegram_enabled' => 'boolean',
         'telegram_token' => 'encrypted',
@@ -75,7 +94,8 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_backup_failure_thread_id' => 'encrypted',
         'telegram_notifications_scheduled_task_success_thread_id' => 'encrypted',
         'telegram_notifications_scheduled_task_failure_thread_id' => 'encrypted',
-        'telegram_notifications_docker_cleanup_thread_id' => 'encrypted',
+        'telegram_notifications_docker_cleanup_success_thread_id' => 'encrypted',
+        'telegram_notifications_docker_cleanup_failure_thread_id' => 'encrypted',
         'telegram_notifications_server_disk_usage_thread_id' => 'encrypted',
         'telegram_notifications_server_reachable_thread_id' => 'encrypted',
         'telegram_notifications_server_unreachable_thread_id' => 'encrypted',
diff --git a/app/Models/WebhookNotificationSettings.php b/app/Models/WebhookNotificationSettings.php
index 731006181..c6a81b50a 100644
--- a/app/Models/WebhookNotificationSettings.php
+++ b/app/Models/WebhookNotificationSettings.php
@@ -33,6 +33,10 @@ class WebhookNotificationSettings extends Model
         'traefik_outdated_webhook_notifications',
     ];
 
+    protected $hidden = [
+        'webhook_url',
+    ];
+
     protected function casts(): array
     {
         return [
diff --git a/resources/views/components/notification/navbar.blade.php b/resources/views/components/notification/navbar.blade.php
index 0ee3b8ee4..256c4d528 100644
--- a/resources/views/components/notification/navbar.blade.php
+++ b/resources/views/components/notification/navbar.blade.php
@@ -2,7 +2,7 @@
     <h1>Notifications</h1>
     <div class="subtitle">Get notified about your infrastructure.</div>
     <div class="navbar-main">
-        <nav class="flex items-center gap-3.5 min-h-10">
+        <nav class="flex items-center gap-6 min-h-10">
             <a class="{{ request()->routeIs('notifications.email') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
                 href="{{ route('notifications.email') }}">
                 <button>Email</button>
diff --git a/tests/Feature/Security/ApiSensitiveFieldsTest.php b/tests/Feature/Security/ApiSensitiveFieldsTest.php
index 0036b8546..09040aca7 100644
--- a/tests/Feature/Security/ApiSensitiveFieldsTest.php
+++ b/tests/Feature/Security/ApiSensitiveFieldsTest.php
@@ -1,8 +1,10 @@
 <?php
 
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\Service;
@@ -101,6 +103,99 @@ function makeTeamUser(): array
     });
 });
 
+describe('GET /api/v1/security/keys sensitive field gating', function () {
+    beforeEach(function () {
+        PrivateKey::withoutEvents(function () {
+            PrivateKey::forceCreate([
+                'uuid' => 'private-key-sensitive-test',
+                'name' => 'Sensitive key',
+                'description' => 'test',
+                'private_key' => 'super-secret-private-key',
+                'is_git_related' => false,
+                'team_id' => $this->team->id,
+            ]);
+        });
+    });
+
+    test('read token does not leak private key material', function () {
+        $token = makeApiToken($this->user, $this->team, ['read']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token,
+        ])->getJson('/api/v1/security/keys/private-key-sensitive-test');
+
+        $response->assertStatus(200);
+
+        expect($response->getContent())->not->toContain('"private_key":');
+    });
+
+    test('read sensitive token sees private key material', function () {
+        $token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token,
+        ])->getJson('/api/v1/security/keys/private-key-sensitive-test');
+
+        $response->assertStatus(200);
+
+        expect($response->getContent())->toContain('"private_key":');
+    });
+});
+
+describe('GET /api/v1/deployments sensitive field gating', function () {
+    beforeEach(function () {
+        $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+        $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+        $destination = $this->server->standaloneDockers()->firstOrFail();
+
+        $this->application = Application::create([
+            'name' => 'deployment-sensitive-test-app',
+            'git_repository' => 'https://github.com/test/test',
+            'git_branch' => 'main',
+            'build_pack' => 'nixpacks',
+            'ports_exposes' => '3000',
+            'environment_id' => $this->environment->id,
+            'destination_id' => $destination->id,
+            'destination_type' => $destination->getMorphClass(),
+        ]);
+
+        ApplicationDeploymentQueue::create([
+            'application_id' => $this->application->id,
+            'deployment_uuid' => 'deployment-sensitive-test',
+            'pull_request_id' => 0,
+            'status' => 'in_progress',
+            'logs' => '[{"output":"super-secret-deployment-log"}]',
+            'server_id' => $this->server->id,
+            'application_name' => $this->application->name,
+            'server_name' => $this->server->name,
+        ]);
+    });
+
+    test('read token does not leak deployment logs', function () {
+        $token = makeApiToken($this->user, $this->team, ['read']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token,
+        ])->getJson('/api/v1/deployments/deployment-sensitive-test');
+
+        $response->assertStatus(200);
+
+        expect($response->getContent())->not->toContain('"logs":');
+    });
+
+    test('read sensitive token sees deployment logs', function () {
+        $token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token,
+        ])->getJson('/api/v1/deployments/deployment-sensitive-test');
+
+        $response->assertStatus(200);
+
+        expect($response->getContent())->toContain('"logs":');
+    });
+});
+
 describe('GET /api/v1/applications nested-relation scrubbing', function () {
     beforeEach(function () {
         $this->project = Project::factory()->create(['team_id' => $this->team->id]);
diff --git a/tests/Unit/Models/SensitiveFieldsHiddenTest.php b/tests/Unit/Models/SensitiveFieldsHiddenTest.php
index f95539d8a..c63a6084d 100644
--- a/tests/Unit/Models/SensitiveFieldsHiddenTest.php
+++ b/tests/Unit/Models/SensitiveFieldsHiddenTest.php
@@ -1,10 +1,23 @@
 <?php
 
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\DiscordNotificationSettings;
+use App\Models\EmailNotificationSettings;
 use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\OauthSetting;
+use App\Models\PrivateKey;
+use App\Models\PushoverNotificationSettings;
+use App\Models\S3Storage;
 use App\Models\Server;
 use App\Models\ServerSetting;
 use App\Models\Service;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\SlackNotificationSettings;
+use App\Models\SslCertificate;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -13,6 +26,8 @@
 use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
+use App\Models\TelegramNotificationSettings;
+use App\Models\WebhookNotificationSettings;
 
 describe('Sensitive model fields are hidden by default', function () {
     test('ServerSetting hides sentinel and logdrain secrets', function () {
@@ -61,12 +76,133 @@
         expect($hidden)->toContain('value', 'real_value');
     });
 
+    test('SharedEnvironmentVariable hides value', function () {
+        $hidden = (new SharedEnvironmentVariable)->getHidden();
+
+        expect($hidden)->toContain('value');
+    });
+
     test('Service hides docker_compose and docker_compose_raw', function () {
         $hidden = (new Service)->getHidden();
 
         expect($hidden)->toContain('docker_compose', 'docker_compose_raw');
     });
 
+    test('ApplicationDeploymentQueue hides logs', function () {
+        $hidden = (new ApplicationDeploymentQueue)->getHidden();
+
+        expect($hidden)->toContain('logs');
+    });
+
+    test('PrivateKey hides private key material', function () {
+        $hidden = (new PrivateKey)->getHidden();
+
+        expect($hidden)->toContain('private_key');
+    });
+
+    test('CloudProviderToken hides provider token', function () {
+        $hidden = (new CloudProviderToken)->getHidden();
+
+        expect($hidden)->toContain('token');
+    });
+
+    test('CloudInitScript hides script content', function () {
+        $hidden = (new CloudInitScript)->getHidden();
+
+        expect($hidden)->toContain('script');
+    });
+
+    test('S3Storage hides credentials', function () {
+        $hidden = (new S3Storage)->getHidden();
+
+        expect($hidden)->toContain('key', 'secret');
+    });
+
+    test('OauthSetting hides client secret', function () {
+        $hidden = (new OauthSetting)->getHidden();
+
+        expect($hidden)->toContain('client_secret');
+    });
+
+    test('SslCertificate hides private key', function () {
+        $hidden = (new SslCertificate)->getHidden();
+
+        expect($hidden)->toContain('ssl_private_key');
+    });
+
+    test('EmailNotificationSettings hides SMTP and resend secrets', function () {
+        $hidden = (new EmailNotificationSettings)->getHidden();
+
+        expect($hidden)->toContain(
+            'smtp_from_address',
+            'smtp_from_name',
+            'smtp_recipients',
+            'smtp_host',
+            'smtp_username',
+            'smtp_password',
+            'resend_api_key',
+        );
+    });
+
+    test('InstanceSettings hides instance notification secrets', function () {
+        $hidden = (new InstanceSettings)->getHidden();
+
+        expect($hidden)->toContain(
+            'smtp_from_address',
+            'smtp_from_name',
+            'smtp_recipients',
+            'smtp_host',
+            'smtp_username',
+            'smtp_password',
+            'resend_api_key',
+            'sentinel_token',
+        );
+    });
+
+    test('Webhook-style notification settings hide delivery endpoints', function () {
+        expect((new DiscordNotificationSettings)->getHidden())->toContain('discord_webhook_url');
+        expect((new SlackNotificationSettings)->getHidden())->toContain('slack_webhook_url');
+        expect((new WebhookNotificationSettings)->getHidden())->toContain('webhook_url');
+    });
+
+    test('PushoverNotificationSettings hides credentials', function () {
+        $hidden = (new PushoverNotificationSettings)->getHidden();
+
+        expect($hidden)->toContain('pushover_user_key', 'pushover_api_token');
+    });
+
+    test('TelegramNotificationSettings hides bot, chat, and thread identifiers', function () {
+        $hidden = (new TelegramNotificationSettings)->getHidden();
+
+        expect($hidden)->toContain(
+            'telegram_token',
+            'telegram_chat_id',
+            'telegram_notifications_deployment_success_thread_id',
+            'telegram_notifications_deployment_failure_thread_id',
+            'telegram_notifications_status_change_thread_id',
+            'telegram_notifications_backup_success_thread_id',
+            'telegram_notifications_backup_failure_thread_id',
+            'telegram_notifications_scheduled_task_success_thread_id',
+            'telegram_notifications_scheduled_task_failure_thread_id',
+            'telegram_notifications_docker_cleanup_success_thread_id',
+            'telegram_notifications_docker_cleanup_failure_thread_id',
+            'telegram_notifications_server_disk_usage_thread_id',
+            'telegram_notifications_server_reachable_thread_id',
+            'telegram_notifications_server_unreachable_thread_id',
+            'telegram_notifications_server_patch_thread_id',
+            'telegram_notifications_traefik_outdated_thread_id',
+        );
+    });
+
+    test('TelegramNotificationSettings casts actual docker cleanup thread ids as encrypted', function () {
+        $casts = (new TelegramNotificationSettings)->getCasts();
+
+        expect($casts)->toMatchArray([
+            'telegram_notifications_docker_cleanup_success_thread_id' => 'encrypted',
+            'telegram_notifications_docker_cleanup_failure_thread_id' => 'encrypted',
+        ]);
+    });
+
     test('StandalonePostgresql hides password, init_scripts, db urls', function () {
         $hidden = (new StandalonePostgresql)->getHidden();