From 77142ecba22fd53d33e7fefa0913e4975a44832e Mon Sep 17 00:00:00 2001 From: 1bcMax Date: Thu, 10 Sep 2026 10:06:12 -0400 Subject: [PATCH] docs(errors): the debug field is redacted, not raw upstream text It promised "raw upstream text", and raw was the bug. Reproduced unauthenticated against production on 2026-09-10: requesting nvidia/nemotron-3-nano-omni-30b-a3b-reasoning returned a debug string linking to openrouter.ai, for a model whose owned_by is deliberately rewritten to nvidia. Gateway fix in BlockRunAI/blockrun. Credentials, URLs and routing infrastructure are now stripped before the response is sent. The status code and the upstream's description of the fault survive, so the field still supports a bug report. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01GJ6wG4k5TgeUgYneCMz1oc --- docs/api-reference/errors.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/api-reference/errors.md b/docs/api-reference/errors.md index 5e527de..9a7fb1a 100644 --- a/docs/api-reference/errors.md +++ b/docs/api-reference/errors.md @@ -21,7 +21,7 @@ BlockRun uses standard HTTP status codes and returns detailed error information. ## Error Response Format -Gateway errors use the OpenAI envelope, with `message` and `code` mirrored at the top level for older clients. `debug` carries the raw upstream text when there is one. +Gateway errors use the OpenAI envelope, with `message` and `code` mirrored at the top level for older clients. `debug` carries the upstream text when there is one, **redacted**: credentials, URLs and any routing infrastructure we do not sell under its own name are removed before the response is sent. The status code and the upstream's own description of the fault survive, so `debug` stays useful for a bug report — it is just not a verbatim copy. ```json { @@ -33,7 +33,7 @@ Gateway errors use the OpenAI envelope, with `message` and `code` mirrored at th }, "message": "Message @bc1max on Telegram for help.", "code": "INVALID_PARAMETER", - "debug": "" + "debug": "" } ```