Stop logging the Google Maps API key; archive security-alerts-2026-10

[BlancaMunizaga]

Follow-up to #63: triages the first CodeQL results, fixes the one real finding, and archives the OpenSpec change security-alerts-2026-10.

Fix: the Google Maps API key no longer reaches the logs

CodeQL (py/clear-text-logging-sensitive-data) flagged the satellite image's debug line, which logged the full Static Maps URL, including key= and signature=. That line only appears at DEBUG.

The same method had a second path, active at the default INFO level, which CodeQL didn't flag. When Google answered with an HTTP error (an invalid key, an exhausted quota), raise_for_status() raised httpx.HTTPStatusError. Its message contains the URL, and it was logged at ERROR and chained into the traceback. The client only ever got a generic 500, but the server logs had the key.

Now:

• the debug line logs only the center, zoom and size;
• an HTTP error logs and raises only its status code, with from None.

A new test fails without the fix and checks that neither the logs nor the raised error contain the key or the signature.

Archive of security-alerts-2026-10

• New spec repository-security-scanning:
  • secret scanning with push protection;
  • CodeQL default setup for Python, JS/TS and Actions, which is not a required check.
• automated-dependency-updates: every alert is fixed or dismissed with a reason, and dependencies outside Dependabot's reach are listed.
• frontend-dependency-toolchain: rules for tarballs from outside the registry and for scoped overrides.
• docs/branch_protection.md: a new "Security scanning" section. The CHANGELOG's Security section is updated too.

Outcome recorded in the tasks

• Dependabot alerts went from 30 to 0. The xlsx ones closed on their own after Resolve the open Dependabot alerts (SheetJS from its CDN, lockfile refresh, overrides) #63.
• Dependabot PRs:
  • the ones on pre-monorepo paths were closed;
  • chore(deps): bump cryptography from 49.0.0 to 50.0.0 in /tools/update-gfw-tmf #58, chore(deps): bump the minor-and-patch group across 1 directory with 2 updates #57 and chore(deps): bump the minor-and-patch group across 1 directory with 6 updates #59 were merged;
  • chore(deps): bump the minor-and-patch group across 1 directory with 4 updates #60 is still open as a routine update.
• Repository scanning: secret scanning, push protection and CodeQL are enabled. Secret scanning found nothing.
• CodeQL's first run reported 3 alerts:
  • two py/path-injection alerts in the layers store were dismissed as false positives: _metadata_path validates the language and the file name, and test_metadata_paths_cannot_escape_the_root covers it;
  • the third is the fix in this PR.

Verified

• 282 API tests pass, and ruff, black and mypy are clean.
• openspec validate --specs passes.