🛡️ Sentinel: [CRITICAL] Fix data leak in public export endpoints

[seonghobae]

🚨 Severity: CRITICAL
💡 Vulnerability: 인증되지 않은 공개 공유 링크(/api/share/.../export.sql 등)를 통해 스냅샷을 내보낼 때, 원본 snapshot_json 데이터를 그대로 사용함으로 인해 내부 스키마 코멘트(comment, relation_comment, column_comment) 및 예시 데이터(example_value)가 유출될 수 있는 취약점이 있었습니다.
🎯 Impact: 악의적인 사용자가 공개된 공유 링크를 통해 데이터베이스 설계자의 민감한 내부 코멘트나 예시 데이터에 접근할 수 있었습니다.
🔧 Fix: SQL 내보내기, 리버싱 스펙, 인덱스 디자인 내보내기 등의 엔드포인트에서 생성 함수로 데이터를 넘기기 전에 _redact_sensitive_snapshot_fields 함수를 호출하여 민감한 데이터를 먼저 제거(redact)하도록 수정했습니다.
✅ Verification: pytest를 통해 기존 기능들이 정상 작동함을 확인했으며, 보안 로깅(.Jules/sentinel.md)도 성공적으로 추가했습니다.

---

PR created automatically by Jules for task 2610164308446578423 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 50019bc2ce65c42a0d44320e2067b31b463e5156
• Workflow run: 29300834753
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode reviewed the current-head evidence but found unresolved reviewer or review-agent threads before approval.

Findings

1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved reviewer thread blocks automated approval

• Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human or review-agent thread evidence on the current pull request.
• Root cause: Reviewer and review-agent feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
• Fix: Address or resolve the listed reviewer thread(s), then re-run OpenCode on the current head.
• Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE, including bot review agents other than OpenCode itself.

Review thread evidence

Latest unresolved reviewer thread evidence

backend/app/api/share.py line 36

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z
• Comment URL: 🛡️ Sentinel: [CRITICAL] Fix data leak in public export endpoints #569 (comment)
• Comment excerpt: ## Module is imported more than once / This import of module re is redundant, as it was previously imported <a class="Link" href="/ContextualWisdomLab/pg-erd-cloud/blob/50019bc2ce65c42a0d44320e2067b31b463e5156/backend/app/api/share.py#L33-L33">on line 33</a>. / --- / <p>To fix this, remove the second duplicate top-level import statements and keep only one copy of each import.</p> / <p>Best single change without altering functionality:</p> / <ul> / <li>File: <code>backend/app/api/share.py</code></li> / <li>Region: around li

backend/app/api/share.py line 33

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z
• Comment URL: 🛡️ Sentinel: [CRITICAL] Fix data leak in public export endpoints #569 (comment)
• Comment excerpt: ## Unused import / Import of 're' is not used. / --- / <p>Remove redundant/unused imports in <code>backend/app/api/share.py</code> where they are duplicated and not referenced in the shown code.</p> / <p>Best single fix (no behavior change):</p> / <ul> / <li>In the import section below <code>router = APIRouter(...)</code>, delete the duplicated import block and keep a single <code>from app.dsn_redaction import redact_dsn_error_message</code>.</li> / <li>Remove both <code>import re</code> lines since

backend/app/api/share.py line 34

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z
• Comment URL: 🛡️ Sentinel: [CRITICAL] Fix data leak in public export endpoints #569 (comment)
• Comment excerpt: ## Unused import / Import of 'redact_dsn_error_message' is not used. / --- / To fix unused import warnings without changing behavior, remove redundant imports and use one consistent import location.</p> / <p>Best fix here:</p> / <ul> / <li>In <code>backend/app/api/share.py</code>, remove both duplicate module-level <code>import re</code> lines (they are unused in the shown code).</li> / <li>Remove both duplicate module-level <code>from app.dsn_redaction import redact_dsn_error_message</code> lines.</li>

backend/app/api/share.py line 36

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z
• Comment URL: 🛡️ Sentinel: [CRITICAL] Fix data leak in public export endpoints #569 (comment)
• Comment excerpt: ## Unused import / Import of 're' is not used. / --- / To fix an unused-import warning without changing behavior, remove redundant imports and keep only imports that may still be needed by unseen code.</p> / <p>Best fix here:</p> / <ul> / <li>In <code>backend/app/api/share.py</code>, remove the second duplicated block: / <ul>

backend/app/api/share.py line 37

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z

• Comment URL: 🛡️ Sentinel: [CRITICAL] Fix data leak in public export endpoints #569 (comment)

• Comment excerpt: ## Unused import / Import of 'redact_dsn_error_message' is not used. / --- / <p>To fix this without changing functionality, remove the duplicated import statements in <code>backend/app/api/share.py</code> so each needed import appears only once.</p> / <p>Best single fix:</p> / <ul> / <li>In the import section near lines 33–37, delete the second <code>import re</code> and second <code>from app.dsn_redaction import redact_dsn_error_message</code>.</li> / <li>Keep the first occurrences (lines 33–35) unchanged.<

• Result: REQUEST_CHANGES

• Reason: unresolved reviewer or review-agent thread(s) were present before approval.

• Head SHA: 50019bc2ce65c42a0d44320e2067b31b463e5156

• Workflow run: 29300834753

• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Backend: share.py"]
  S2 --> I2["API and service runtime"]
  I2 --> R2["Review risk: Backend: share.py"]
  R2 --> V2["backend tests"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head evidence but found unresolved reviewer or review-agent threads before approval.

Findings

1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved reviewer thread blocks automated approval

• Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human or review-agent thread evidence on the current pull request.
• Root cause: Reviewer and review-agent feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
• Fix: Address or resolve the listed reviewer thread(s), then re-run OpenCode on the current head.
• Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE, including bot review agents other than OpenCode itself.

Review thread evidence

Latest unresolved reviewer thread evidence

backend/app/api/share.py line 36

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z
• Comment URL: #569 (comment)
• Comment excerpt: ## Module is imported more than once / This import of module re is redundant, as it was previously imported <a class="Link" href="/ContextualWisdomLab/pg-erd-cloud/blob/50019bc2ce65c42a0d44320e2067b31b463e5156/backend/app/api/share.py#L33-L33">on line 33</a>. / --- / <p>To fix this, remove the second duplicate top-level import statements and keep only one copy of each import.</p> / <p>Best single change without altering functionality:</p> / <ul> / <li>File: <code>backend/app/api/share.py</code></li> / <li>Region: around li

backend/app/api/share.py line 33

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z
• Comment URL: #569 (comment)
• Comment excerpt: ## Unused import / Import of 're' is not used. / --- / <p>Remove redundant/unused imports in <code>backend/app/api/share.py</code> where they are duplicated and not referenced in the shown code.</p> / <p>Best single fix (no behavior change):</p> / <ul> / <li>In the import section below <code>router = APIRouter(...)</code>, delete the duplicated import block and keep a single <code>from app.dsn_redaction import redact_dsn_error_message</code>.</li> / <li>Remove both <code>import re</code> lines since

backend/app/api/share.py line 34

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z
• Comment URL: #569 (comment)
• Comment excerpt: ## Unused import / Import of 'redact_dsn_error_message' is not used. / --- / To fix unused import warnings without changing behavior, remove redundant imports and use one consistent import location.</p> / <p>Best fix here:</p> / <ul> / <li>In <code>backend/app/api/share.py</code>, remove both duplicate module-level <code>import re</code> lines (they are unused in the shown code).</li> / <li>Remove both duplicate module-level <code>from app.dsn_redaction import redact_dsn_error_message</code> lines.</li>

backend/app/api/share.py line 36

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z
• Comment URL: #569 (comment)
• Comment excerpt: ## Unused import / Import of 're' is not used. / --- / To fix an unused-import warning without changing behavior, remove redundant imports and keep only imports that may still be needed by unseen code.</p> / <p>Best fix here:</p> / <ul> / <li>In <code>backend/app/api/share.py</code>, remove the second duplicated block: / <ul>

backend/app/api/share.py line 37

• Latest reviewer comment: @github-code-quality at 2026-07-14T02:22:11Z

• Comment URL: #569 (comment)

• Comment excerpt: ## Unused import / Import of 'redact_dsn_error_message' is not used. / --- / <p>To fix this without changing functionality, remove the duplicated import statements in <code>backend/app/api/share.py</code> so each needed import appears only once.</p> / <p>Best single fix:</p> / <ul> / <li>In the import section near lines 33–37, delete the second <code>import re</code> and second <code>from app.dsn_redaction import redact_dsn_error_message</code>.</li> / <li>Keep the first occurrences (lines 33–35) unchanged.<

• Result: REQUEST_CHANGES

• Reason: unresolved reviewer or review-agent thread(s) were present before approval.

• Head SHA: 50019bc2ce65c42a0d44320e2067b31b463e5156

• Workflow run: 29300834753

• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Backend: share.py"]
  S2 --> I2["API and service runtime"]
  I2 --> R2["Review risk: Backend: share.py"]
  R2 --> V2["backend tests"]

Loading