[knittingcode]

Summary

Symfony's router logs every matched route at info on the request channel with the full request URI, query string included. That contradicts docs/architecture/observability.md ("query strings … are not logged"). Found by the overnight security review (OVN-104); reproduced on the dev stack, where a value sent as /api/v1/system/status?sprintcheck=… appeared in the api log.

Change

LogRedactor replaces the query string (and fragment) of values under URL keys (request_uri, uri, url, referer, referrer) with ?[redacted], as the edge's access log already does. The request channel stays enabled, because Symfony also logs uncaught exceptions there.

Tests

• Two unit tests in JsonLineFormatterTest: the router record's query value (an e-mail and a page number) is removed; a URL without a query is kept.
• Local, in the dev api image with the worktree mounted:
  • unit tests 114/114 and architecture tests 23/23;
  • PHPStan, PHP-CS-Fixer and both Deptrac configurations clean.
• Integration and stack suites: in this PR's CI.

Limitations

• Values under other keys are still only scrubbed by the existing credential patterns.
• The raw exception text in the readiness and status logs (review item OVN-L2) is unchanged. It is already scrubbed and needed for diagnosis.

Updates after the audit (2026-10-24)

• Merged main. Main, including fix(docker): upgrade brotli-libs for CVE-2026-111497 in the runtime images #18, was merged into the branch with a merge commit (no force push).
• More URL keys. redirect_uri, location, target_path, href and return_to are now URL keys too (e5e0082). A unit test checks every URL key.
• ST-43 can now catch the leak this PR fixes. It previously sent only ?token=, which was masked even before this PR. It now also sends ?search=…, a value the old code logged in request_uri (de5873b).
• Referer leak (confirmed). Symfony writes the full Referer into the message of an unknown route ("No route found … (from "")"), at info level on the request channel. A ?search=marker in the Referer was confirmed in the log against real PHP-FPM.
  • LogRedactor::scrub() now removes the query and fragment of any scheme:// URL in free text (3e640ee).
  • Added LoggingTest::testTheQueryOfAReferrerIsNotLogged and unit cases (e967d86).
  • Added the negative control "URL queries kept in log text". Its tests failed 6 of 6 when it was applied.
  • Updated docs/architecture/observability.md.
• Local results:
  • Unit tests: 130.
  • Full integration suite in a disposable project: 267 OK.
  • PHPStan, PHP-CS-Fixer and Deptrac clean.
• Limitation: relative URLs in free text (/path?x) are not cleaned. Symfony's 404 message contains the absolute requested URL without its query, plus the Referer.
• Merge authorized by the owner (task FCRM-SEC-023M-016M), after fix(security): share the login limits across every spelling of an account #23.

Updates before the merge (2026-10-24)

• Merged main with fix(security): share the login limits across every spelling of an account #23 (fa6b09d, merge commit, no conflicts, no force push).
• Relative URLs under URL keys (c514fbc): testEveryUrlKeyLosesTheQueryOfARelativeUrl checks every URL key with /accounts?search=…#…. Only the key rule protects such values; before, removing it went unnoticed because absolute test URLs are also masked by the free-text rule. A new negative control, "URL keys keep their query", removes the key rule (11 of 11 tests fail under it).
• Real-stack Referer check (e1aa80a): ST-43 now also requests an unknown route with Referer: https://crm.example.test/accounts?search=<marker>. The marker must be in neither the api log (real PHP-FPM, dev Monolog configuration on stderr) nor the edge access log, and both records of that request must quote the Referer as …/accounts?[redacted], so the check cannot pass when the record is missing.
• Docs (531c132): the redaction table lists the URL key rule; the negative-control count is 38 (it said 35; main had 36 after fix(security): share the login limits across every spelling of an account #23).
• Local results (head 531c132): unit 145, architecture 23, PHPStan, PHP-CS-Fixer, Deptrac and ShellCheck (-x) clean; in a disposable Compose project, LoggingTest, JsonLineFormatterTest and SecurityLoggingTest OK (66 tests), and both logging controls detected.
• Still not covered: relative URLs in free text, a " inside a query (browsers encode it), and PHP errors raised before Symfony's handlers exist, which PHP-FPM writes to stderr unredacted (unchanged by this PR).