[efraespada]

Credential health checks now keep API credentials out of curl’s process arguments and reject empty or multiline values. This reduces credential exposure while preserving checks for all eight providers.

What changed

• Pass authentication headers to curl through stdin and disable curl configuration loading.
• Reject missing credentials and values containing carriage returns or newlines.
• Use the x-goog-api-key header for Google and send Cursor credentials through a Basic authorization header.
• Keep redirects disabled and restrict requests to HTTPS.

Validation

• The credential transport contract is covered by 82 cases in fix(security): keep credential health secrets out of curl arguments copilot#683.
• YAML lint and native PR review are identified as validation steps; completion is not confirmed.

Review notes

• Complete the native PR review and confirm all applicable checks pass with no pending findings before merge.

[vypbot]

Bugbot: review complete

Current status: No active findings on f4eceb2.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: This pull request is outside the configured approval scope.
Completed: 3/3 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: f4eceb2298ff; base: e2a0d57970d5; reason: scope.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.05%. Comparing base (b28ddf1) to head (f4eceb2).
⚠️ Report is 106 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master     #158       +/-   ##
===========================================
- Coverage   64.09%   51.05%   -13.05%     
===========================================
  Files          12       12               
  Lines         454      570      +116     
===========================================
  Hits          291      291               
- Misses        163      279      +116     

Flag	Coverage Δ
cli	47.30% <ø> (-14.26%)	⬇️
platform_interface	85.71% <ø> (ø)
zstandard	76.36% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.