Public /api/config never exposes credential-like site settings; join page spacing

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-10 08:04:19 -05:00
parent b7f2b3ef3f
commit e0d4bbc2e1
2 changed files with 5 additions and 2 deletions
@@ -516,9 +516,12 @@ const server = http.createServer(async (req, res) => {
    // -- public API
    if (p === '/api/config' && req.method === 'GET') {
      const c = chain.getConfig();
+      // public copy of the site settings: never anything that looks like a credential
+      const pubSite = {};
+      for (const [k, v] of Object.entries(siteConfig())) if (!/secret|token|password|private|apikey|api_key/i.test(k)) pubSite[k] = v;
      return json(res, 200, Object.assign({ contract: c.contract, chainId: c.chainId,
        chainName: c.chainName, explorer: c.explorer, rpc: c.rpcs[0],
-        emailAuth: mailer.hasKey() || !IS_PROD }, siteConfig()));
+        emailAuth: mailer.hasKey() || !IS_PROD }, pubSite));
    }
    if (p === '/api/moonpay-url' && req.method === 'GET') {
      // Card on-ramp deep link. With MoonPay keys set — PUBLIC key via