Redact secrets from public client configuration output

[Lakes41]

Difficulty: Hard

Type: Bug

Summary

Prevent getConfig() from returning sensitive configuration values such as apiKey by default.

Current Behaviour

GuildPassClient.getConfig() returns a shallow copy of the full merged configuration object. If apiKey is present, callers can accidentally log or expose it.

Expected Behaviour

The public config accessor should either redact sensitive values by default or provide a separate explicit method for internal unsafe access.

Suggested Implementation

Update getConfig() to return a safe configuration object where apiKey is omitted or replaced with [REDACTED]. If maintainers need raw config internally, keep it private or expose an intentionally named method such as getUnsafeConfigForDebugging.

Files or Areas Likely Affected

• src/client/GuildPassClient.ts
• src/config/sdkConfig.ts
• src/types/
• tests/client.test.ts
• docs/sdk-guide.md

Acceptance Criteria

• getConfig() does not return the raw API key
• Other non-sensitive config fields remain visible
• Tests prove apiKey is redacted or omitted
• Documentation explains the safe config accessor behaviour
• Existing SDK functionality continues to use the real API key internally
• No hooks or logs expose the API key through config output

Additional Notes

This is a defensive security improvement for users who log SDK configuration during debugging.

[Meet-hybrid]

Can I work on this please?

[Sus-Nexus07]

Hi maintainers,

I'd like to work on this issue.

I have already been contributing to the GuildPass ecosystem and I'm familiar with the repository structure and testing workflow. For this issue, I plan to:

• Review the current implementation of GuildPassClient.getConfig() and identify where the merged configuration is exposed.
• Introduce a safe public configuration output that omits or redacts sensitive values such as apiKey.
• Ensure all non-sensitive configuration fields remain accessible through the public accessor.
• Add comprehensive tests to verify that sensitive values are never returned while existing SDK functionality continues to operate with the real API key internally.
• Update documentation to clearly explain the behaviour of the safe config accessor and any internal debugging alternatives if needed.

Given that this is a security-focused improvement, I will also review related configuration and logging paths to ensure secrets are not accidentally exposed elsewhere.

Looking forward to working on this issue.

[grantfox-oss]

🦊 GrantFox — @Sus-Nexus07 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #84)
2. Your PR will be reviewed by the Adamantine-guild maintainers

Good luck! Track your progress on GrantFox.