fix(security): sanitize CWE-209 response errors

[Copilot]

Canonical issue

Outcome

Prevents exception diagnostics from reaching HTTP clients through generated endpoints, persisted response trees, and 5xx response constructors while retaining server-side logs.

Scope

• Included:
  • Static client-safe errors for generated, cloud, real API, and adapter paths.
  • Recursive sanitization of persisted error, error_message, and errors response fields.
  • AST guard coverage for 500–599 statuses, positional JSONResponse bodies, and src/uvai/ml.
• Explicitly excluded:
  • Workflow, dependency, and deployment changes.

except Exception:
    logger.exception("Generated endpoint failed")
    raise HTTPException(status_code=500, detail="Internal server error")

Risk

• Risk level: low
• Failure mode: Clients receive stable generic error text instead of provider diagnostics.
• Rollback: Revert b22dda0.

Verification

Current head: b22dda0

• Focused tests — 221 passed
• Required CI
• Review threads resolved

Production evidence

Not applicable: changes affect Python backend paths; Vercel preview builds apps/web.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Execution: remove CWE-209 response-body leaks (PR #831) #912

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:57pm UTC

[vercel]

The CWE-209 response sanitization (JSON parse + recursive tree-walk + re-serialize) runs synchronously on the asyncio event loop in get_video_analysis and get_processed_videos_list, reintroducing the exact size-proportional loop stall the surrounding worker-thread offload was designed to prevent.