Sync from GitHub (tests passed)

app/inference.py

@@ -69,7 +69,8 @@ def get_current_price(session: Session, symbol: str) -> Optional[float]:
                         logger.info(f"Using Twelve Data price for copper: ${float(price):.4f}")
                         return float(price)
         except Exception as e:
-            logger.debug(f"Twelve Data price fetch failed: {e}")
+            from app.settings import mask_api_key
+            logger.debug(f"Twelve Data price fetch failed: {mask_api_key(str(e))}")
     
     # Try yfinance as fallback
     try:

app/main.py

@@ -513,8 +513,9 @@ async def get_live_price():
                 return {"price": None, "error": f"API error: {response.status_code}"}
                 
     except Exception as e:
-        logger.error(f"Twelve Data API error: {e}")
-        return {"price": None, "error": str(e)}
+        from app.settings import mask_api_key
+        logger.error(f"Twelve Data API error: {mask_api_key(str(e))}")
+        return {"price": None, "error": "API error"}
 
 
 # =============================================================================
@@ -586,9 +587,12 @@ async def websocket_live_price(websocket: WebSocket):
                 heartbeat_task.cancel()
                 
     except Exception as e:
-        logger.error(f"WebSocket error: {e}")
+        # Mask potential API keys in error messages
+        from app.settings import mask_api_key
+        safe_error = mask_api_key(str(e))
+        logger.error(f"WebSocket error: {safe_error}")
         try:
-            await websocket.send_json({"error": str(e)})
+            await websocket.send_json({"error": "Connection error"})  # Don't expose details
         except Exception:
             pass
 

app/settings.py

@@ -155,3 +155,32 @@ def get_settings() -> Settings:
     return Settings()
 
 
+def mask_api_key(text: str, settings: Settings = None) -> str:
+    """
+    Mask API keys in text to prevent leaking in logs.
+    Replaces known API key patterns with masked versions.
+    """
+    import re
+    
+    if settings is None:
+        settings = get_settings()
+    
+    result = text
+    
+    # Mask known API keys
+    keys_to_mask = [
+        settings.twelvedata_api_key,
+        settings.openrouter_api_key,
+        settings.newsapi_key,
+        settings.pipeline_trigger_secret,
+    ]
+    
+    for key in keys_to_mask:
+        if key and len(key) > 8:
+            masked = f"{key[:4]}...{key[-4:]}"
+            result = result.replace(key, masked)
+    
+    # Also mask any apikey= query params
+    result = re.sub(r'apikey=[a-zA-Z0-9_-]+', 'apikey=***MASKED***', result)
+    
+    return result