fix(cli): mask query tokens in uvicorn access log

src/beaver_gateway/cli.py

@@ -24,6 +24,7 @@ import asyncio
 import contextlib
 import functools
 import logging
+import re
 import signal
 from contextlib import AsyncExitStack
 from typing import TYPE_CHECKING, Any
@@ -286,8 +287,30 @@ def _plain_postgres_url(url: str) -> str | None:
     return None
 
 
+_TOKEN_IN_QUERY = re.compile(r"(token=)[^&\s\"]+")
+
+
+class ScrubQueryTokens(logging.Filter):
+    """Mask ``?token=…`` in uvicorn access lines.
+
+    Webhook senders that cannot set headers put the secret in the URL, and
+    ``docker logs`` is not a vault.
+    """
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        if isinstance(record.args, tuple):
+            record.args = tuple(
+                _TOKEN_IN_QUERY.sub(r"\1<…>", a) if isinstance(a, str) else a
+                for a in record.args
+            )
+        elif isinstance(record.msg, str):
+            record.msg = _TOKEN_IN_QUERY.sub(r"\1<…>", record.msg)
+        return True
+
+
 async def _serve_root(gateway: Gateway, *, extra: dict[str, ASGIApp]) -> None:
     app = build_root_app(gateway.frontends, extra=extra)
+    logging.getLogger("uvicorn.access").addFilter(ScrubQueryTokens())
     config = uvicorn.Config(app, host=gateway.host, port=gateway.port, log_level="info")
     _log.info(
         "gateway on http://%s:%d - %s",