This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 146bb2c497c4 chore: docs - the security model lists the endpoint URIs
in the JSON of the dev consoles as a known non-finding
146bb2c497c4 is described below
commit 146bb2c497c4a7ef32fe4b29da3a567ca7397b86
Author: Claus Ibsen <[email protected]>
AuthorDate: Wed Oct 14 14:02:17 2026 +0200
chore: docs - the security model lists the endpoint URIs in the JSON of the
dev consoles as a known non-finding
The JSON output of a dev console shows endpoint URIs with their secrets,
while its text output masks them. The dev consoles are development tools,
and their JSON is what the tools use to send to, browse and compare
endpoints; a masked URI no longer reaches the endpoint it names. Listed as
a known non-finding so that scans stop reporting it (CAMEL-25446, closed as
won't fix).
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Signed-off-by: Claus Ibsen <[email protected]>
---
docs/user-manual/modules/ROOT/pages/security-model.adoc | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/docs/user-manual/modules/ROOT/pages/security-model.adoc
b/docs/user-manual/modules/ROOT/pages/security-model.adoc
index 5a7f95013bd6..712c68e3ad85 100644
--- a/docs/user-manual/modules/ROOT/pages/security-model.adoc
+++ b/docs/user-manual/modules/ROOT/pages/security-model.adoc
@@ -1278,6 +1278,13 @@ Disposition is `KNOWN-NON-FINDING` (see _Triage
dispositions_).
by design; the few calls the developer confirms are listed in _Developer
tools_, which is the contract. See the AI-assistant entry in _Out of
scope_.
+* *"The JSON output of a dev console shows endpoint URIs with their
+ secrets, while its text output masks them."* The dev consoles are
+ development tools (see _Developer tools_ and the profile entry in _Out
+ of scope_), and their JSON is what the tools use to address and compare
+ endpoints: sending to an endpoint, browsing one, matching the URIs of
+ routes and endpoints. A masked URI no longer reaches the endpoint it
+ names, so masking it would break them.
=== Triage dispositions
