fix(hltb): redact session material from the request debug log

The debug log printed the session headers and the honeypot pair verbatim.
The token decodes to "<issued-at>::<public IP>|<user agent>|<key>|<hmac>",
so anyone pasting DEBUG logs into a bug report published their host's public
IP address. Logs are also downloadable through /api/logs.

Redact the session headers and drop the honeypot entry from the logged
payload, keeping the URL, search terms and timeout that make the line useful.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: sdornan

backend/handler/metadata/hltb_handler.py

@@ -27,6 +27,12 @@
 HLTB_RATE_LIMIT_BACKOFF_SECONDS: Final[float] = 2
 _rate_limiter = RateLimiter(HLTB_MAX_REQUESTS_PER_SECOND)
 
+# The session token decodes to "<issued-at>::<public IP>|<user agent>|<key>|<hmac>",
+# so logging it would put the host's public IP in any shared log or support bundle.
+HLTB_SESSION_HEADERS: Final[frozenset[str]] = frozenset(
+    {"x-auth-token", "x-hp-key", "x-hp-val"}
+)
+
 
 class HLTBPlatform(TypedDict):
     slug: str
@@ -332,8 +338,11 @@ async def _request(self, url: str, payload: dict) -> dict:
             log.debug(
                 "HowLongToBeat API request: URL=%s, Headers=%s, Payload=%s, Timeout=%s",
                 url,
-                headers,
-                body,
+                {
+                    key: "[redacted]" if key in HLTB_SESSION_HEADERS else value
+                    for key, value in headers.items()
+                },
+                {key: value for key, value in body.items() if key != self.hp_key},
                 60,
             )
 

backend/tests/handler/metadata/test_hltb_handler.py

@@ -166,6 +166,30 @@ async def test_github_endpoint_fetch_is_not_rate_limited(
     acquire.assert_not_awaited()
 
 
+@patch("handler.metadata.hltb_handler.HLTB_API_ENABLED", True)
+@patch("handler.metadata.hltb_handler.ctx_httpx_client")
+async def test_debug_log_does_not_leak_session_material(mock_ctx_httpx_client):
+    # Logs are downloadable via /api/logs and routinely pasted into bug reports,
+    # and the token decodes to a string containing the host's public IP.
+    handler = _handler()
+    mock_client = AsyncMock()
+    mock_client.post.return_value = _response(json_body={"data": []})
+    mock_ctx_httpx_client.get.return_value = mock_client
+
+    with patch("handler.metadata.hltb_handler.log.debug") as mock_debug:
+        await handler._request(
+            "https://howlongtobeat.com/api/bleed", {"searchTerms": ["Chrono"]}
+        )
+
+    logged = repr(mock_debug.call_args.args)
+    for secret in ("token-1", "ign_aaaa", "val-1"):
+        assert secret not in logged
+
+    # The parts that make the log useful are still there.
+    assert "Chrono" in logged
+    assert "[redacted]" in logged
+
+
 @patch("handler.metadata.hltb_handler.HLTB_API_ENABLED", True)
 @patch("handler.metadata.hltb_handler.ctx_httpx_client")
 async def test_request_backs_off_and_retries_on_429(mock_ctx_httpx_client):