fix(security): sanitize CWE-209 response errors

[Copilot]

Canonical issue

Outcome

Prevents exception diagnostics from reaching HTTP clients through generated endpoints, persisted response trees, and 5xx response constructors while retaining server-side logs.

Scope

• Included:
  • Static client-safe errors for generated, cloud, real API, and adapter paths.
  • Recursive sanitization of persisted error, error_message, and errors response fields.
  • AST guard coverage for 500–599 statuses, positional JSONResponse bodies, and src/uvai/ml.
• Explicitly excluded:
  • Workflow, dependency, and deployment changes.

except Exception:
    logger.exception("Generated endpoint failed")
    raise HTTPException(status_code=500, detail="Internal server error")

Risk

• Risk level: low
• Failure mode: Clients receive stable generic error text instead of provider diagnostics.
• Rollback: Revert b22dda0.

Verification

Current head: b22dda0

• Focused tests — 221 passed
• Required CI
• Review threads resolved

Production evidence

Not applicable: changes affect Python backend paths; Vercel preview builds apps/web.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Execution: remove CWE-209 response-body leaks (PR #831) #912

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:57pm UTC

[vercel]

The CWE-209 response sanitization (JSON parse + recursive tree-walk + re-serialize) runs synchronously on the asyncio event loop in get_video_analysis and get_processed_videos_list, reintroducing the exact size-proportional loop stall the surrounding worker-thread offload was designed to prevent.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 54d3dc8c-592c-4229-a456-0f6f52e0c320

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA b22dda0.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[cursor]

Backlog triage: leaving open. CWE-209 sanitize (#912) is CONFLICTING vs rewritten main. Kept as the single rebase target after closing #1690.