Epic. Threat model: single-user dev CLI on a workstation — but the API key grants full org access to a healthcare-adjacent platform, so key confidentiality is the prize. No slam-dunk P1 here; the exposure is a cluster of cheap-to-close key-leak paths. (Verified clean: 0600 config perms, loopback bind, TLS on, no InsecureSkipVerify, no pull_request_target misuse, no browser-launch command injection.)

Issues

• setup config server has no CSRF/Origin/Host defense #123 — [P2] setup config server has no CSRF/Origin/Host defense (drive-by config poisoning → key exfil)
• --debug prints request bodies, leaking service auth secrets #124 — [P2] --debug prints request bodies incl. services auth secrets unredacted
• API-key header survives cross-host redirect; http base URLs allowed #125 — [P2] custom Syllable-API-Key header survives a cross-host 307; http:// base allowed
• Interpolated path/query segments are not url-escaped #126 — [P2] interpolated path/query segments not url.PathEscape-d
• Hardening: setup idle timeout, maskKey breadth, install.sh checksum fail-open #127 — [P3] setup idle timeout, maskKey breadth, install.sh checksum fail-open

Suggested order

124 and 125 are the cheapest key-leak closers (S each). 123 is the highest-impact but M. 126 pairs with the api-contract path fixes. 127 last.

Filed from a full code review, June 2026.