build(security): floor guard-core at 4.0.0 and fastapi-guard at 8.0.0 for redacted block logs

guard-core 4.0.0 redacts authorization, proxy-authorization, cookie and x-api-key to [REDACTED] on every guard log line and event, closing the 3.17.0 leak (proven here with a new blocked-request test). It also stops fully silencing excluded_detection_headers for non-identity headers, so x-auth-token and x-odysseus-internal-token (real secrets, not in guard-core's hardcoded redaction set) now get an explicit log_sensitive_headers entry to keep the same guarantee. fastapi-guard 8.0.0 floors guard-core>=4.0.0.

Audited: no require_headers()/require_referrer() usage, enable_redis=False so the 4.0.0 rate-limit key hashing is a no-op, and no websocket routes exist under this perimeter.

Author: rennf93

core/guard.py

@@ -271,10 +271,22 @@ async def _global_content_scan(request):
             "context", "workspace", "approved_plan", "search_context",
             "target_language", "email_translate_language",
         },
+        # guard-core >= 4.0.0 no longer fully silences a header listed here: it
+        # inherits identity-header logic (skips only the ssrf category, and only
+        # for IP-shaped values) and every other category still scans it. In
+        # practice all six below are still scanned by SQLi/XSS/traversal/etc,
+        # same as an unlisted header. authorization and x-api-key don't need the
+        # entry any more since guard-core's own hardcoded sensitive-header set
+        # redacts them to [REDACTED] in every log line regardless. x-auth-token
+        # and x-odysseus-internal-token carry real secrets (integration API
+        # keys, the internal tool-call token) and aren't in that hardcoded set,
+        # so log_sensitive_headers below adds them explicitly. x-odysseus-owner
+        # and x-tz-offset carry a username and a UTC offset, not secrets.
         excluded_detection_headers={
             "authorization", "x-api-key", "x-auth-token",
             "x-odysseus-internal-token", "x-odysseus-owner", "x-tz-offset",
         },
+        log_sensitive_headers=frozenset({"x-auth-token", "x-odysseus-internal-token"}),
         # Free-text search and mailbox-folder query parameters. A user searching
         # their own history for "DROP TABLE" is not an attack. Path-like params
         # (path, filepath) stay scanned so traversal detection still applies.

requirements-optional.txt

@@ -50,16 +50,17 @@ markitdown[docx,pptx,xlsx,xls]==0.1.6
 # detection, honeypot auto-ban, per-route size/content-type caps, and log-only
 # credential-into-corpus / prompt-injection signals. Wired in core/guard.py and
 # only imported when the flag is set, so the default install stays unchanged.
-fastapi-guard>=7.8.2
-# guard-core >= 3.15.0 stops printing its own console line when the host app
-# has root handlers, so guard events reach Odysseus's console and file log
-# once. >= 3.16.0 closes a TTLCache check-then-use race on the IP-ban read
-# path that could silently skip a banned IP's block under this perimeter's
-# passive-mode fail_secure=False, so it is load-bearing for threat_ban_config
-# / auto_ban_threshold below. >= 3.17.0 adds a last-known dynamic-rules
-# snapshot; a no-op here, since this perimeter never enables dynamic rules
-# (enable_agent=False).
-guard-core>=3.17.0
+fastapi-guard>=8.0.0
+# guard-core >= 4.0.0 redacts authorization, proxy-authorization, cookie and
+# x-api-key (plus query-string and body secrets) as [REDACTED] on every guard
+# log line, event and hook payload, closing the leak where 3.17.0 wrote those
+# headers verbatim on every block (proven under TestClient in this perimeter,
+# see tests/test_guard_perimeter_security.py). Separately, its default
+# excluded-header set skips proxy identity headers (x-forwarded-for and
+# friends) from the ssrf category only; every other detection category
+# still scans them.
+# >= 8.0.0 floors guard-core>=4.0.0.
+guard-core>=4.0.0
 # GeoIP country lookup for ODYSSEUS_GUARD_BLOCK_COUNTRIES (needs a MaxMind
 # GeoLite2/GeoIP2 country .mmdb pointed to by ODYSSEUS_GUARD_GEOIP_DB). Only
 # used when country blocking is enabled.

tests/test_guard_perimeter_security.py

@@ -317,6 +317,66 @@ async def search(q: str = ""):
     assert result.stdout.strip().endswith("OK")
 
 
+@requires_guard
+def test_blocked_request_log_redacts_credentials():
+    result = _run(
+        """
+        import logging
+
+        from fastapi import FastAPI, APIRouter, Request
+        from starlette.testclient import TestClient
+        from guard import SecurityMiddleware
+        import core.guard as g
+
+        router = APIRouter()
+
+        @router.post("/api/thing")
+        async def thing(request: Request):
+            return {"ok": True}
+
+        app = FastAPI()
+        app.add_middleware(SecurityMiddleware, config=g.security_config)
+        app.state.guard_decorator = g.guard_deco
+        app.include_router(router)
+
+        records = []
+        handler = logging.Handler()
+        handler.emit = lambda record: records.append(record.getMessage())
+        guard_logger = logging.getLogger("guard_core")
+        guard_logger.addHandler(handler)
+        guard_logger.setLevel(logging.WARNING)
+
+        client = TestClient(app, client=("127.0.0.1", 12345))
+        attack = "1' UNION SELECT password FROM users -- "
+        resp = client.post(
+            "/api/thing",
+            json={"weird": attack},
+            headers={
+                "Authorization": "Bearer sekrit-token",
+                "Cookie": "session=sekrit-cookie",
+                "X-Api-Key": "sekrit-key",
+                "X-Auth-Token": "sekrit-integration-token",
+                "X-Odysseus-Internal-Token": "sekrit-internal-token",
+            },
+        )
+        assert resp.status_code == 400, resp.status_code
+        assert records, "no guard_core log records captured"
+        blob = "\\n".join(records)
+        assert "sekrit-token" not in blob, blob
+        assert "sekrit-cookie" not in blob, blob
+        assert "sekrit-key" not in blob, blob
+        assert "sekrit-integration-token" not in blob, blob
+        assert "sekrit-internal-token" not in blob, blob
+        assert "[REDACTED]" in blob, blob
+        print("OK")
+        """,
+        ODYSSEUS_GUARD_ENABLED="true",
+        ODYSSEUS_GUARD_PASSIVE="false",
+    )
+    assert result.returncode == 0, result.stderr
+    assert result.stdout.strip().endswith("OK")
+
+
 @requires_guard
 def test_active_mode_blocks_scanner_user_agents_and_accepts_form_routes():
     result = _run(