hyperping 1.7.0__tar.gz → 1.8.0__tar.gz

{hyperping-1.7.0 → hyperping-1.8.0}/CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [1.8.0] - 2026-05-31
+
+This is a security-focused release. It closes several credential-leak and validation gaps surfaced by an independent audit. One change is breaking for local-development workflows; see Upgrade Notes below.
+
+### Security
+
+- `validate_base_url` is now applied at every constructor that accepts a `base_url` or `mcp_url`: both the sync and async REST clients, both MCP transports, and the high-level MCP clients. The validator rejects non-`https` URLs by default, rejects URLs that carry userinfo (`user:pass@host` or bare `user@host`), and rejects URLs with a query string or fragment. The `Authorization: Bearer` header therefore cannot reach an attacker-controlled host through a misconfigured base URL.
+- `HyperpingAPIError.response_body` is now recursively redacted at construction time. Sensitive keys (authorization, tokens, cookies, set-cookie, request headers, request body, emails, webhooks) are replaced with `[REDACTED]`. Free-form string values are scrubbed for `Bearer <token>` and `sk_<token>` shapes. The recursion is bounded to prevent `RecursionError` from pathological payloads. Applies to all subclasses, including `HyperpingRateLimitError`.
+- `HyperpingAPIError` formatted messages now strip C0 control bytes (preserving `\t` and `\n`) and cap at 256 characters, so a server-supplied error string carrying ANSI escapes or a 1 KB blob cannot poison terminal output or downstream log pipelines.
+- The MCP transport no longer captures the first 500 bytes of server response as `response_body["raw"]` on rate-limit (429), generic HTTP error, or JSON-parse failure paths. Subscriber emails or webhook URLs that the server may echo cannot leak through that channel.
+- `_utils.parse_list` no longer logs the full `pydantic.ValidationError` string on per-item parse failures (Pydantic v2 includes the offending input by default). It now logs only the exception class and field locations.
+- The `breaker_key_fn` callback is now used through an LRU-bounded map. A custom callback that returns unbounded unique strings can no longer leak memory in long-running processes: the per-endpoint breaker map is capped at 1024 entries and evicts oldest on overflow. Applies to both sync and async clients.
+
+### Added
+
+- `allow_insecure: bool = False` keyword argument on every constructor that accepts a `base_url` or `mcp_url`. When set to `True`, `http://` URLs are permitted and an `InsecureTransportWarning` is emitted. Provided for local-development workflows; not recommended for production.
+- `InsecureTransportWarning` warning class exported from `hyperping`.
+
+### Changed
+
+- `_parse_retry_after` documents that it intentionally supports only the delta-seconds form of the `Retry-After` header. HTTP-date values fall through to exponential backoff rather than raising. Trade-off is documented in the docstring; no behavioral change for callers passing the integer form.
+
+### Upgrade Notes
+
+If your code instantiates `HyperpingClient` (or any MCP client) against a `http://localhost` URL for local development or against a mock server, the constructor will now raise `ValueError`. Pass `allow_insecure=True` to opt in, and expect an `InsecureTransportWarning` at runtime:
+
+```python
+from hyperping import HyperpingClient
+
+client = HyperpingClient(
+    api_key="sk_test_xxx",
+    base_url="http://localhost:8000",
+    allow_insecure=True,
+)
+```
+
+Production callers using `https://api.hyperping.io` are unaffected.
+
+URLs that previously carried embedded credentials (`https://user:pass@api.example.com`) or a trailing query string / fragment will now also raise at construction time. Refactor to pass credentials through `api_key` and to keep query strings out of the base URL.
+
 ## [1.7.0] - 2026-05-21
 
 ### Added

{hyperping-1.7.0 → hyperping-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hyperping
-Version: 1.7.0
+Version: 1.8.0
 Summary: Python SDK for the Hyperping uptime monitoring and incident management API
 Project-URL: Homepage, https://github.com/develeap/hyperping-python
 Project-URL: Documentation, https://github.com/develeap/hyperping-python#readme

{hyperping-1.7.0 → hyperping-1.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hyperping"
-version = "1.7.0"
+version = "1.8.0"
 description = "Python SDK for the Hyperping uptime monitoring and incident management API"
 readme = {file = "README.md", content-type = "text/markdown"}
 license = {text = "MIT"}

{hyperping-1.7.0 → hyperping-1.8.0}/src/hyperping/_async_client.py

@@ -15,6 +15,7 @@ import asyncio
 import logging
 import random
 import threading
+from collections import OrderedDict
 from collections.abc import Callable
 from typing import Any
 from urllib.parse import urlsplit
@@ -33,8 +34,13 @@ from hyperping._circuit_breaker import (
     CircuitBreakerConfig,
     CircuitState,
 )
-from hyperping._internals import DEFAULT_USER_AGENT, RETRY_AFTER_MAX, sanitize_for_log
-from hyperping.client import DEFAULT_RETRY_CONFIG, RetryConfig
+from hyperping._internals import (
+    DEFAULT_USER_AGENT,
+    RETRY_AFTER_MAX,
+    sanitize_for_log,
+    validate_base_url,
+)
+from hyperping.client import _ENDPOINT_BREAKERS_MAX, DEFAULT_RETRY_CONFIG, RetryConfig
 from hyperping.endpoints import API_BASE, Endpoint
 from hyperping.exceptions import (
     HyperpingAPIError,
@@ -79,6 +85,7 @@ class AsyncHyperpingClient(
         user_agent: str | None = None,
         per_endpoint_circuit_breaker: bool = False,
         breaker_key_fn: Callable[[str], str] | None = None,
+        allow_insecure: bool = False,
     ) -> None:
         """Initialize the async Hyperping API client.
 
@@ -106,14 +113,17 @@ class AsyncHyperpingClient(
         if not raw_key or not raw_key.strip():
             raise ValueError("api_key must be a non-empty string")
         self._api_key = SecretStr(raw_key) if isinstance(api_key, str) else api_key
-        self.base_url = (base_url or self.DEFAULT_BASE_URL).rstrip("/")
+        self.base_url = validate_base_url(
+            base_url or self.DEFAULT_BASE_URL,
+            allow_insecure=allow_insecure,
+        )
         self.timeout = timeout
         self.retry_config = retry_config or DEFAULT_RETRY_CONFIG
         self._circuit_breaker_config = circuit_breaker_config
         self._circuit_breaker = CircuitBreaker(circuit_breaker_config)
         self._per_endpoint_circuit_breaker = per_endpoint_circuit_breaker
         self._breaker_key_fn = breaker_key_fn
-        self._endpoint_breakers: dict[str, CircuitBreaker] = {}
+        self._endpoint_breakers: OrderedDict[str, CircuitBreaker] = OrderedDict()
         self._endpoint_breakers_lock = threading.Lock()
 
         self._client = httpx.AsyncClient(
@@ -167,17 +177,39 @@ class AsyncHyperpingClient(
         return pure
 
     def _breaker_for(self, path: str) -> CircuitBreaker:
-        """Return the breaker that governs ``path`` (shared, or per-endpoint)."""
+        """Return the breaker that governs ``path`` (shared, or per-endpoint).
+
+        The critical section under ``_endpoint_breakers_lock`` is purely
+        CPU-bound (a single ``OrderedDict.get`` / ``__setitem__`` /
+        ``move_to_end`` / ``popitem``) and never awaits, so wrapping it in a
+        ``threading.Lock`` does not block the event loop in practice; the
+        loop only "stalls" for the duration of one dict operation, which is
+        well below the resolution of any asyncio scheduling decision.
+
+        We keep ``threading.Lock`` (rather than ``asyncio.Lock``) so the same
+        breaker map remains safe if a caller drives the async client from
+        multiple OS threads (e.g. via ``loop.run_in_executor`` or a thread
+        pool that re-enters the SDK). Switching to ``asyncio.Lock`` would
+        make the per-endpoint path correct only on the loop that owns the
+        lock; ``threading.Lock`` is correct in both cases. Regression
+        coverage:
+        ``tests/unit/test_security_breaker_cap.py
+        ::test_async_breaker_lock_does_not_deadlock_under_gather``.
+        """
         if not self._per_endpoint_circuit_breaker:
             return self._circuit_breaker
         key = self._resolve_breaker_key(path)
-        # threading.Lock here is intentional: see HyperpingClient._breaker_for
-        # for the rationale (works under both pure-asyncio and mixed-thread use).
         with self._endpoint_breakers_lock:
             breaker = self._endpoint_breakers.get(key)
             if breaker is None:
                 breaker = CircuitBreaker(self._circuit_breaker_config)
                 self._endpoint_breakers[key] = breaker
+                # Evict LRU once the cap is hit to bound memory under a
+                # pathological breaker_key_fn (see HyperpingClient).
+                while len(self._endpoint_breakers) > _ENDPOINT_BREAKERS_MAX:
+                    self._endpoint_breakers.popitem(last=False)
+            else:
+                self._endpoint_breakers.move_to_end(key)
             return breaker
 
     def circuit_breaker_state_for(self, path: str) -> CircuitState:
@@ -220,7 +252,12 @@ class AsyncHyperpingClient(
             return {"error": response.text or "Unknown error"}
 
     def _parse_retry_after(self, response: httpx.Response) -> int | None:
-        """Extract and parse the ``Retry-After`` header value."""
+        """Extract and parse the ``Retry-After`` header value.
+
+        Only the delta-seconds form (RFC 7231 7.1.3) is parsed; HTTP-date
+        is intentionally not supported (see
+        :meth:`HyperpingClient._parse_retry_after` for rationale).
+        """
         retry_after = response.headers.get("Retry-After")
         if not retry_after:
             return None

{hyperping-1.7.0 → hyperping-1.8.0}/src/hyperping/_async_mcp_client.py

@@ -50,11 +50,13 @@ class AsyncHyperpingMcpClient:
         api_key: str | SecretStr,
         base_url: str = MCP_URL,
         timeout: float = 30.0,
+        allow_insecure: bool = False,
     ) -> None:
         self._transport = AsyncMcpTransport(
             api_key=api_key,
             base_url=base_url,
             timeout=timeout,
+            allow_insecure=allow_insecure,
         )
 
     # ==================== Internal ====================

{hyperping-1.7.0 → hyperping-1.8.0}/src/hyperping/_async_mcp_transport.py

@@ -12,6 +12,7 @@ from typing import Any
 import httpx
 from pydantic import SecretStr
 
+from hyperping._internals import validate_base_url
 from hyperping._version import __version__
 from hyperping.endpoints import MCP_URL
 from hyperping.exceptions import (
@@ -53,9 +54,14 @@ class AsyncMcpTransport:
         base_url: str = MCP_URL,
         timeout: float = 30.0,
         max_retries: int = 2,
+        allow_insecure: bool = False,
     ) -> None:
         token = api_key.get_secret_value() if isinstance(api_key, SecretStr) else api_key
-        self._url = base_url.rstrip("/")
+        self._url = validate_base_url(
+            base_url,
+            allow_insecure=allow_insecure,
+            param_name="base_url",
+        )
         self._client = httpx.AsyncClient(
             headers={
                 "Authorization": f"Bearer {token}",
@@ -116,11 +122,13 @@ class AsyncMcpTransport:
                     retry_after = int(raw_retry)
                 except ValueError:
                     pass
+            # Drop the raw body for the same reason as the sync transport:
+            # the structured exception still carries retry_after.
             raise HyperpingRateLimitError(
                 "Rate limit exceeded",
                 retry_after=retry_after,
                 status_code=429,
-                response_body={"raw": resp.text[:500]},
+                response_body=None,
             )
         if resp.status_code in (400, 422):
             raise HyperpingValidationError(
@@ -128,10 +136,14 @@ class AsyncMcpTransport:
                 status_code=resp.status_code,
             )
         if resp.status_code != 200:
+            # Drop the raw body for the same reason as the 429 path: the server
+            # may echo subscriber emails, webhook URLs, or other PII in free-
+            # form error text that the structured key-based redactor cannot
+            # match. The status code in the exception is enough for callers.
             raise HyperpingAPIError(
                 f"MCP server returned HTTP {resp.status_code}",
                 status_code=resp.status_code,
-                response_body={"raw": resp.text[:500]},
+                response_body=None,
             )
 
         # HTTP 200. Parse the body so we classify JSON-RPC errors (including
@@ -145,7 +157,7 @@ class AsyncMcpTransport:
             raise HyperpingAPIError(
                 "MCP server returned 200 with non-JSON body",
                 status_code=200,
-                response_body={"raw": resp.text[:500]},
+                response_body=None,
             ) from None
 
         if isinstance(data, dict) and "error" in data:
@@ -292,10 +304,12 @@ class AsyncMcpTransport:
         try:
             return json.loads(text)
         except json.JSONDecodeError as exc:
+            # Server-controlled ``text`` may carry PII; drop it instead of
+            # embedding the first 500 bytes into the exception.
             raise HyperpingAPIError(
                 f"Failed to parse MCP tool response: {exc}",
                 status_code=200,
-                response_body={"raw": text[:500]},
+                response_body=None,
             ) from exc
 
     async def close(self) -> None:

hyperping-1.8.0/src/hyperping/_internals.py

@@ -0,0 +1,241 @@
+"""Shared internal constants and helpers used by both sync and async clients.
+
+Not part of the public API.
+"""
+
+from __future__ import annotations
+
+import re
+import warnings
+from typing import Any
+from urllib.parse import urlsplit
+
+from hyperping._version import __version__
+
+# Maximum time to honour a server-requested Retry-After value (5 minutes)
+RETRY_AFTER_MAX = 300.0
+
+# Default User-Agent header value
+DEFAULT_USER_AGENT = f"hyperping-python/{__version__}"
+
+# Known JSON body keys whose values must not appear in debug logs (M15)
+_SENSITIVE_LOG_KEYS = frozenset(
+    {"authorization", "x-api-key", "api_key", "request_headers", "request_body"}
+)
+
+
+class InsecureTransportWarning(UserWarning):
+    """Warning emitted when the client is configured to use plaintext HTTP.
+
+    Plaintext transport ships the Bearer API key in clear text on every
+    request. Allowed only as an explicit opt-in (``allow_insecure=True``)
+    for local development and integration testing.
+    """
+
+
+def validate_base_url(
+    url: str,
+    *,
+    allow_insecure: bool = False,
+    param_name: str = "base_url",
+) -> str:
+    """Validate that *url* is a safe, well-formed API base URL.
+
+    Rejects:
+    - non-string / empty input
+    - URLs that don't parse to ``scheme://host`` form
+    - URLs with userinfo (``user:pass@host``, ``user@host``, ``@host``, etc.);
+      credentials in URLs are a common exfiltration vector and are never
+      legitimate for this SDK. Even an empty userinfo segment is rejected
+      because ``urlsplit`` reports it as ``username == ""`` (falsy), which
+      would slip past a simple truthiness check.
+    - URLs carrying a query string or fragment; a base URL must be limited
+      to ``scheme://host[/path]`` so attacker-controlled ``?api_key=...``
+      values cannot be smuggled into every subsequent request.
+    - non-``https`` schemes, unless *allow_insecure* is ``True``
+
+    When *allow_insecure* permits an ``http://`` URL, an
+    :class:`InsecureTransportWarning` is emitted so the operator sees the
+    downgrade in their logs.
+
+    Returns the URL with any trailing slash stripped. Raises ``ValueError``
+    on any rejection.
+    """
+    if not isinstance(url, str) or not url.strip():
+        raise ValueError(f"{param_name} must be a non-empty string")
+
+    try:
+        parts = urlsplit(url.strip())
+    except ValueError as exc:
+        raise ValueError(f"{param_name} is not a parseable URL: {url!r}") from exc
+
+    if parts.scheme not in ("http", "https"):
+        raise ValueError(
+            f"{param_name} must use the https scheme (got {parts.scheme!r} in {url!r})"
+        )
+
+    # ``urlsplit`` accepts strings without ``//`` (e.g. ``not a url``) and
+    # produces an empty netloc; reject any URL without a hostname.
+    if not parts.hostname:
+        raise ValueError(f"{param_name} must include a host (got {url!r})")
+
+    # Reject any userinfo, including the empty / partial forms
+    # (``https://@host``, ``https://:@host``). ``parts.username`` is an empty
+    # string in those cases, so the previous ``or`` truthiness guard let them
+    # through. Checking the raw authority for ``@`` is exhaustive.
+    if (
+        "@" in parts.netloc
+        or parts.username is not None
+        or parts.password is not None
+    ):
+        raise ValueError(
+            f"{param_name} must not embed userinfo (credentials) in the URL"
+        )
+
+    if parts.query or parts.fragment:
+        raise ValueError(
+            f"{param_name} must not carry a query string or fragment "
+            f"(got {url!r})"
+        )
+
+    if parts.scheme == "http":
+        if not allow_insecure:
+            raise ValueError(
+                f"{param_name} uses the insecure http scheme; pass allow_insecure=True "
+                f"to opt in to plaintext transport (development only)"
+            )
+        warnings.warn(
+            f"{param_name}={url!r} uses plaintext http; the Bearer API key "
+            "will be transmitted in clear text",
+            InsecureTransportWarning,
+            stacklevel=3,
+        )
+
+    return url.rstrip("/")
+
+
+def sanitize_for_log(data: dict[str, Any] | None) -> dict[str, Any] | None:
+    """Return a copy of *data* with sensitive values replaced by ``[REDACTED]``.
+
+    Prevents tokens and header values from leaking into DEBUG-level log output.
+    """
+    if data is None:
+        return None
+    return {k: "[REDACTED]" if k.lower() in _SENSITIVE_LOG_KEYS else v for k, v in data.items()}
+
+
+# Keys whose values are redacted recursively from any structured payload that
+# may end up attached to an exception. Over-redact when uncertain: it is
+# always safer to drop a string from a server response than to ship a secret
+# into a logging pipeline.
+_SENSITIVE_RESPONSE_KEYS = frozenset(
+    {
+        "authorization",
+        "x-api-key",
+        "api_key",
+        "apikey",
+        "token",
+        "access_token",
+        "refresh_token",
+        "secret",
+        "password",
+        "cookie",
+        "set-cookie",
+        "session",
+        "subscriber_email",
+        "subscribers",
+        "email",
+        "webhook",
+        "webhook_url",
+        "webhookurl",
+        "request_headers",
+        "request_body",
+        "headers",
+    }
+)
+
+# Maximum length of an embedded error message in formatted exception output.
+_ERROR_MESSAGE_MAX_LEN = 256
+# Control-byte stripper: drop C0 controls except TAB and LF. CR is dropped to
+# avoid log-injection line splicing.
+_CONTROL_BYTES_RE = re.compile(r"[\x00-\x08\x0b-\x1f\x7f]")
+
+# Token-shaped substrings to scrub from server-supplied string values. Captures
+# Bearer-style ("Bearer sk_xxx" / "Bearer eyJ...") and bare sk_-prefixed keys
+# (the documented Hyperping API key shape).
+_TOKEN_VALUE_RES: tuple[re.Pattern[str], ...] = (
+    re.compile(r"(?i)bearer\s+\S+"),
+    re.compile(r"\bsk_[A-Za-z0-9_\-]{4,}"),
+)
+
+
+def _scrub_token_strings(value: str) -> str:
+    """Replace Bearer / sk_-prefixed tokens inside a free-form string."""
+    for pattern in _TOKEN_VALUE_RES:
+        value = pattern.sub("[REDACTED]", value)
+    return value
+
+
+# Maximum nesting depth the redactor will descend into before substituting a
+# truncation sentinel. A malicious / malformed server could otherwise return
+# a deeply nested JSON payload that blows the interpreter recursion limit
+# inside ``HyperpingAPIError.__init__`` (masking the original HTTP failure).
+# 32 is comfortably deeper than any real-world API response.
+_REDACT_MAX_DEPTH = 32
+
+# Marker substituted in place of a subtree that exceeds the depth cap. Stable
+# shape so callers / tests can detect the truncation.
+_REDACT_TRUNCATED_SENTINEL = {"_truncated": "max depth reached"}
+
+
+def redact_response_body(value: Any, _depth: int = 0) -> Any:
+    """Recursively redact sensitive keys from a parsed JSON response body.
+
+    Mirrors the key list used by :func:`sanitize_for_log` but applied at any
+    depth so server payloads that echo request headers or carry subscriber
+    PII can be attached to exceptions without leaking secrets through
+    ``logging.exception`` / traceback printing.
+
+    Lists and tuples are walked element-wise; primitive values are returned
+    unchanged. The structure is copied; the input is not mutated.
+
+    Recursion is capped at :data:`_REDACT_MAX_DEPTH`; deeper subtrees are
+    replaced with :data:`_REDACT_TRUNCATED_SENTINEL` so a pathological 5000-
+    level payload cannot raise ``RecursionError`` inside the exception
+    constructor.
+    """
+    if _depth >= _REDACT_MAX_DEPTH:
+        # Return a fresh copy so callers cannot mutate the shared sentinel.
+        return dict(_REDACT_TRUNCATED_SENTINEL)
+    if isinstance(value, dict):
+        redacted: dict[Any, Any] = {}
+        for k, v in value.items():
+            key_str = str(k).lower() if isinstance(k, str) else k
+            if isinstance(key_str, str) and key_str in _SENSITIVE_RESPONSE_KEYS:
+                redacted[k] = "[REDACTED]"
+            else:
+                redacted[k] = redact_response_body(v, _depth + 1)
+        return redacted
+    if isinstance(value, list):
+        return [redact_response_body(v, _depth + 1) for v in value]
+    if isinstance(value, tuple):
+        return tuple(redact_response_body(v, _depth + 1) for v in value)
+    if isinstance(value, str):
+        return _scrub_token_strings(value)
+    return value
+
+
+def sanitize_error_message(message: str) -> str:
+    """Strip control bytes and clamp length on an exception message.
+
+    Server-supplied error strings can carry ANSI escapes (terminal-injection)
+    or arbitrarily long payloads; both are unsafe to forward into log lines
+    or terminals verbatim. TAB and LF are preserved so multi-line validation
+    errors keep their shape.
+    """
+    if not isinstance(message, str):
+        message = str(message)
+    cleaned = _CONTROL_BYTES_RE.sub("", message)
+    if len(cleaned) > _ERROR_MESSAGE_MAX_LEN:
+        cleaned = cleaned[: _ERROR_MESSAGE_MAX_LEN - 3] + "..."
+    return cleaned

{hyperping-1.7.0 → hyperping-1.8.0}/src/hyperping/_mcp_transport.py

@@ -12,6 +12,7 @@ from typing import Any
 import httpx
 from pydantic import SecretStr
 
+from hyperping._internals import validate_base_url
 from hyperping._version import __version__
 from hyperping.endpoints import MCP_URL
 from hyperping.exceptions import (
@@ -53,9 +54,14 @@ class McpTransport:
         base_url: str = MCP_URL,
         timeout: float = 30.0,
         max_retries: int = 2,
+        allow_insecure: bool = False,
     ) -> None:
         token = api_key.get_secret_value() if isinstance(api_key, SecretStr) else api_key
-        self._url = base_url.rstrip("/")
+        self._url = validate_base_url(
+            base_url,
+            allow_insecure=allow_insecure,
+            param_name="base_url",
+        )
         self._client = httpx.Client(
             headers={
                 "Authorization": f"Bearer {token}",
@@ -116,11 +122,14 @@ class McpTransport:
                     retry_after = int(raw)
                 except ValueError:
                     pass
+            # Drop the raw body: the server may echo request fields here, and
+            # the structured exception already conveys "Rate limit exceeded"
+            # plus retry_after for the caller's back-off logic.
             raise HyperpingRateLimitError(
                 "Rate limit exceeded",
                 retry_after=retry_after,
                 status_code=429,
-                response_body={"raw": resp.text[:500]},
+                response_body=None,
             )
         if resp.status_code in (400, 422):
             raise HyperpingValidationError(
@@ -128,10 +137,14 @@ class McpTransport:
                 status_code=resp.status_code,
             )
         if resp.status_code != 200:
+            # Drop the raw body for the same reason as the 429 path: the server
+            # may echo subscriber emails, webhook URLs, or other PII in free-
+            # form error text that the structured key-based redactor cannot
+            # match. The status code in the exception is enough for callers.
             raise HyperpingAPIError(
                 f"MCP server returned HTTP {resp.status_code}",
                 status_code=resp.status_code,
-                response_body={"raw": resp.text[:500]},
+                response_body=None,
             )
 
         # HTTP 200. Parse the body so we classify JSON-RPC errors (including
@@ -145,7 +158,7 @@ class McpTransport:
             raise HyperpingAPIError(
                 "MCP server returned 200 with non-JSON body",
                 status_code=200,
-                response_body={"raw": resp.text[:500]},
+                response_body=None,
             ) from None
 
         if isinstance(data, dict) and "error" in data:
@@ -293,10 +306,12 @@ class McpTransport:
         try:
             return json.loads(text)
         except json.JSONDecodeError as exc:
+            # Server-controlled ``text`` may carry PII; drop it instead of
+            # embedding the first 500 bytes into the exception.
             raise HyperpingAPIError(
                 f"Failed to parse MCP tool response: {exc}",
                 status_code=200,
-                response_body={"raw": text[:500]},
+                response_body=None,
             ) from exc
 
     def close(self) -> None:

{hyperping-1.7.0 → hyperping-1.8.0}/src/hyperping/_utils.py

@@ -115,9 +115,23 @@ def parse_list(
             results.append(model_cls.model_validate(item))  # type: ignore[attr-defined]
         except (ValueError, ValidationError) as exc:
             skipped += 1
-            # Log only the exception, not the raw item - it may contain
-            # sensitive data (subscriber emails, custom auth headers).
-            logger.warning("Failed to parse %s data: %s", label, exc)
+            # Log a structural summary only. Pydantic's full ValidationError
+            # string includes the offending input value, which can echo
+            # sensitive data (subscriber emails, custom auth headers, etc.).
+            if isinstance(exc, ValidationError):
+                locations = [".".join(str(p) for p in err.get("loc", ())) for err in exc.errors()]
+                logger.warning(
+                    "Failed to parse %s data: %s at %s",
+                    label,
+                    type(exc).__name__,
+                    locations,
+                )
+            else:
+                logger.warning(
+                    "Failed to parse %s data: %s",
+                    label,
+                    type(exc).__name__,
+                )
 
     if skipped:
         logger.warning(