Execution: remove CWE-209 response-body leaks (PR #831)

[groupthinking]

Parent governance program

Focused CWE-209 execution unit under #898. PR #831 and branch claude/determined-maxwell-7xje6x are the single canonical implementation and remain draft until current-head review and the historical provenance boundary are resolved.

Objective

Prevent client-visible exception disclosure across HTTP response constructors, generated FastAPI endpoints, persisted response trees, and the src/uvai/ml serving surface while preserving full server-side diagnostics.

Declared file scope

• src/agents/specialized/code_generator.py
• src/youtube_extension/backend/cloud_ai_routes.py
• src/youtube_extension/backend/cloud_api_endpoints.py
• src/youtube_extension/backend/real_api_endpoints.py
• src/youtube_extension/backend/services/youtube/adapters/official_api.py
• tests/unit/test_500_info_disclosure.py
• tests/unit/test_cloud_routes.py
• tests/unit/test_code_generator_agent.py
• tests/unit/test_real_api_endpoints.py

Acceptance criteria

• Refresh the existing fix(security): restore CWE-209 response protections #831 branch onto current main@995fa268 without force.
• Restore constructor-aware 500–599 scanning, positional JSONResponse body inspection, and src/uvai/ml coverage.
• Generate static HTTP 500 responses and retain full server-side exception logging.
• Preserve cloud/real API response-tree sanitization.
• Limit the final diff to the nine declared CWE-209 files.
• Pass exact-head CI, Coverage, CodeQL, Security Scan, Secret Scan, and Dependency Review; E2E is repository-skipped.
• Complete current-head independent review with no unresolved substantive findings.
• Resolve the historical pre-dispatch intent/trusted-agent-result boundary.
• Obtain final human review.

Exact-head evidence

• Head: 1a0ce654ad6c1e7092c37532e85f847bf9e6f787
• Base: current main@995fa2682809483b483be7fddee43b834ed0d4f7
• Ahead 13 / behind 0; mergeable; nine declared files.
• CI 30362956222, Coverage 30362956346, CodeQL 30362956225, Security 30362956149, Secret Scan 30362956284, and Dependency Review 30362956261 pass.
• E2E 30362956255 is repository-skipped.
• Zero unresolved review threads. Current-head Copilot and CodeRabbit reviews were requested on 2026-07-29; artifacts are pending.

Agent login

groupthinking

Agent run ID

eventrelay-cwe209-regression-repair-20260728T0018Z

Execution receipt

• Agent login: groupthinking
• Run ID: eventrelay-cwe209-regression-repair-20260728T0018Z
• Canonical branch/PR: claude/determined-maxwell-7xje6x / fix(security): restore CWE-209 response protections #831
• Claimed timestamp: 2026-07-28T00:18:00Z
• Latest verified heartbeat: 2026-07-29T13:30:00Z
• Exact head: 1a0ce654ad6c1e7092c37532e85f847bf9e6f787

Historical provenance boundary

PR #831 predates this focused issue and its original declared agent was claude. That pre-dispatch snapshot and a terminal event from the historical agent cannot be manufactured retroactively. The controller records only its own identity and keeps the PR draft.

Deployment applicability

Vercel builds apps/web; these Python paths are deployment-non-applicable. Preview cancellation is not runtime evidence. No merge or production mutation is authorized.

[linear-code]

MYX-94

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

🔗 Related PRs

#277 - Vercel remediation complete: waitUntil adoption + active middleware + @vercel/functions package (resolves three user-defined outcomes; 16-agent verification-gate consolidated PASS on full matrix) [closed]
#404 - fix(web): sync package-lock with @vercel/functions (unblocks #277 auto-merge) [merged]
#805 - fix(security): complete information-disclosure hardening for 500 responses (supersedes #801) [merged]
#834 - fix(security): close global 500 exception-handler info-disclosure leak (CWE-209) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!