Enforce HTTPS-Only Remote Signer Transport and Suppress Sensitive Error Leakage

[mertcano]

Description

This pull request addresses transport security and information leakage findings identified in the workspace security audit for builder-signing-sdk[cite: 37]. Previously, remote signer configurations permitted plain http:// endpoints and credential-embedded URLs while potentially exposing bearer tokens and authorization headers via raw Axios error logging[cite: 37]. This PR strictly enforces HTTPS URL validation, strips credential-bearing endpoints, suppresses raw remote error output, updates SDK documentation, and integrates focused regression tests[cite: 37].

Key Changes & Remediations

1. Remote Signer Transport Security (src/config.ts)

• Strict HTTPS Validation: Replaced permissive endpoint parsing with a strict validator (validateRemoteUrl) requiring protocol === 'https:'[cite: 37]. Non-HTTPS protocols or unparseable URLs immediately throw "invalid remote url!"[cite: 37].
• Credential Stripping: Disallowed embedded userinfo (username or password) in remote signer URLs to prevent accidental credential leakage and confusion during bearer token transmission[cite: 37].

2. Information Leakage Suppression (src/config.ts)

• Sanitized Error Handling: Suppressed raw remote error logging in generateBuilderHeaders[cite: 37]. Transport and network errors now resolve cleanly to undefined without dumping raw Axios error objects or leaking Authorization: Bearer <token> headers to console.error[cite: 37].

3. Documentation & Regression Testing (README.md, test/builderConfig.test.ts)

• Regression Tests: Added test coverage asserting rejection of http:// endpoints, credential-bearing URLs (https://user:password@...), and invalid strings, while verifying that console.error is not invoked upon remote signer failure[cite: 37].
• Documentation Alignment: Updated README.md code snippets and configuration examples to demonstrate secure HTTPS usage, current constructor conventions, and bearer token handling[cite: 37].

How to Review

1. URL Validation: Inspect validateRemoteUrl in src/config.ts to confirm both protocol and userinfo checks fail fast with "invalid remote url!"[cite: 37].
2. Error Logging: Verify in src/config.ts that catch blocks around the remote post request do not log error objects[cite: 37].
3. Test Suite: Review test/builderConfig.test.ts to verify unit tests mock and assert the new security constraints[cite: 37].

---

Note

Medium Risk
Breaking change for integrators using http:// remote signers; behavior change masks remote failures without logging, which may complicate debugging.

Overview
Tightens remote signer security in BuilderConfig: remote URLs must be HTTPS with no embedded userinfo, replacing the prior http:// / https:// prefix check.

On remote signing failures, generateBuilderHeaders no longer logs raw Axios errors (which could expose bearer tokens); it returns undefined instead. Local credential validation now rejects missing/blank fields explicitly.

README is updated for Polymarket branding, BuilderConfig examples (env vars, separate local vs remote flows), and HTTPS/token guidance. Tests cover rejected URLs and silent error handling; existing remote tests use https:// URLs.

^{Reviewed by Cursor Bugbot for commit 1acb72f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit c372ae2. Configure here.}

[mertcano]

Resolved in the latest commit. Reverted the helper call signature back to the expected { data: payload, headers: ... } options object consumed by http-helpers/index.ts, while preserving error suppression to prevent authorization header leaks.