Merge pull request 'fix(security): stop httpx from logging GNEWS_API_KEY in plaintext' (#13) from fix/redact-gnews-token-logs into main

bot/main.py

@@ -27,6 +27,12 @@ logging.basicConfig(
     level=logging.INFO,
     format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
 )
+# httpx logs every request URL at INFO, and the GNews URL carries the API key as
+# a `?token=` query param — that would leak GNEWS_API_KEY in plaintext into the
+# pod logs.  Raise httpx/httpcore to WARNING so request URLs never reach INFO.
+# The bot's own GNews log lines only print the sanitised query, not the token.
+logging.getLogger("httpx").setLevel(logging.WARNING)
+logging.getLogger("httpcore").setLevel(logging.WARNING)
 log = logging.getLogger("bot.main")
 
 PAPER_MODE = os.getenv("PAPER_MODE", "true").lower() == "true"