[HIGH] Information disclosure through metrics

[emiperez95]

Security Issue

Metrics expose sensitive information including absolute file paths, session IDs, and internal architecture details.

Exposed Data

• Full database paths: /Users/emilianoperez/Projects/...
• Session IDs (even truncated)
• Agent names revealing internal logic
• Error details with stack traces

Location

Multiple locations in prometheus_exporter.py

Fix Tasks

1. Hash sensitive identifiers

import hashlib
def hash_session_id(session_id):
    return hashlib.sha256(session_id.encode()).hexdigest()[:8]

2. Remove absolute paths

database_info.info({
    'database': 'agent_workflow.db',  # Not full path
    'total_invocations': str(total_invocations),
})

3. Add metric filtering

SENSITIVE_LABELS = ['file_path', 'session_id', 'error_details']

def sanitize_metric_value(label, value):
    if label in SENSITIVE_LABELS:
        return hash_value(value)
    return value

Effort: 2 hours

References

• PR feat: Add comprehensive monitoring with Prometheus and Grafana #1
• Related to [CRITICAL] No authentication on Prometheus metrics endpoint #6 (Authentication)