Andras Bacsai 8b7dbbafb2 fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens ... Models now declare $hidden for passwords, tokens, db URLs, and compose fields. API controllers flip from makeHidden-on-deny to makeVisible-on- allow (can_read_sensitive=true), fixing fields that were never hidden. Also adds missing fields (mysql/mariadb passwords, logdrain keys, etc.) to privileged disclosure lists. Tests added: Feature/Security/ApiSensitiveFieldsTest and Unit/Models/SensitiveFieldsHiddenTest cover all affected models and controllers.		2026-04-30 11:28:06 +02:00
..
ApiSensitiveFieldsTest.php	fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens	2026-04-30 11:28:06 +02:00
AuditLogTest.php	feat(observability): add structured audit log channel for API and webhook events	2026-04-28 14:50:37 +02:00