fix(security): keep auth credentials out of tracked config.json

'config --set auth.value TOKEN' previously wrote the secret into the
git-tracked config.json. Now:

- core/config.py: load order is defaults -> config.json ->
  config.local.json (gitignored overlay) -> env vars
  APIPROBER_AUTH_VALUE / APIPROBER_AUTH_TYPE (highest precedence,
  never written to disk)
- new set_config_value() routes secret keys (auth.value) to
  config.local.json and writes only the raw user file instead of the
  fully merged defaults (no more config drift in the tracked file)
- cmd_config masks the secret on the console and recommends the env
  var; numeric type conversion now also handles negative integers
- .gitignore: add config.local.json
- README: new 'Credential Handling' section, project structure updated

Adds regression tests (secret routing, overlay, env precedence,
no-drift writes).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Lukas Geiger

.gitignore

@@ -33,8 +33,9 @@ _private/
 .venv/
 venv/
 
-# Environment Variables
+# Environment Variables / local secrets
 .env
+config.local.json
 
 # Logs
 *.log

README.md

@@ -122,6 +122,23 @@ python api_prober.py config --set delay_ms 1000
 python api_prober.py config --set auth.type bearer
 ```
 
+### Credential Handling
+
+Credentials are kept out of the tracked `config.json` and out of the local
+SQLite database:
+
+- **Recommended:** set the environment variables `APIPROBER_AUTH_VALUE` (and
+  optionally `APIPROBER_AUTH_TYPE`). They take precedence over all config
+  files and are never written to disk.
+- `python api_prober.py config --set auth.value "TOKEN"` writes the value to
+  `config.local.json` -- a gitignored overlay file next to `config.json` --
+  never to the tracked `config.json`.
+- Config resolution order: defaults -> `config.json` -> `config.local.json`
+  -> environment variables.
+- Probe run configurations stored in the SQLite database have `auth.value`
+  redacted (`***REDACTED***`); `resume` re-reads the credential from the
+  current config or environment.
+
 ---
 
 ## Discovery Strategies
@@ -152,7 +169,8 @@ ApiProber is designed for responsible API exploration:
 ```
 ApiProber/
 +-- api_prober.py        CLI entry point
-+-- config.json          Default configuration
++-- config.json          Default configuration (no secrets)
++-- config.local.json    Local overrides incl. auth.value -- gitignored
 +-- core/                Core modules
 |   +-- config.py        Configuration management
 |   +-- database.py      SQLite persistence layer

api_prober.py

@@ -185,11 +185,11 @@ def cmd_resume(args):
 
 def cmd_config(args):
     """Konfiguration anzeigen oder setzen."""
-    from ApiProber.core.config import load_config, save_config
-
-    config = load_config()
+    from ApiProber.core.config import (load_config, set_config_value,
+                                       SECRET_KEYS, ENV_AUTH_VALUE)
 
     if args.show:
+        config = load_config()
         print(json.dumps(config, indent=4, ensure_ascii=False))
         return 0
 
@@ -200,25 +200,24 @@ def cmd_config(args):
         # Typ-Konvertierung
         if value.lower() in ("true", "false"):
             value = value.lower() == "true"
-        elif value.isdigit():
-            value = int(value)
-        else:
+        elif key not in SECRET_KEYS:
             try:
-                value = float(value)
+                value = int(value)
             except ValueError:
-                pass  # bleibt String
-
-        # Verschachtelte Keys mit Punkt-Notation
-        keys = key.split(".")
-        target = config
-        for k in keys[:-1]:
-            if k not in target or not isinstance(target[k], dict):
-                target[k] = {}
-            target = target[k]
-        target[keys[-1]] = value
-
-        save_config(config)
-        print(f"Gesetzt: {key} = {value}")
+                try:
+                    value = float(value)
+                except ValueError:
+                    pass  # bleibt String
+
+        target_path = set_config_value(key, value)
+
+        if key in SECRET_KEYS:
+            # Secret nie auf der Konsole oder in der getrackten Datei zeigen
+            print(f"Gesetzt: {key} = ***  ->  {target_path.name} (gitignored)")
+            print(f"Hinweis: Empfohlen ist die Umgebungsvariable {ENV_AUTH_VALUE} --")
+            print("sie hat Vorrang vor allen Config-Dateien und landet nie auf der Platte.")
+        else:
+            print(f"Gesetzt: {key} = {value}  ->  {target_path.name}")
         return 0
 
     print("Verwendung: config --show | config --set KEY VALUE")

core/config.py

@@ -5,6 +5,7 @@
 Pattern: llmauto/core/config.py (DEFAULT + load/save + deepcopy)
 """
 import json
+import os
 from pathlib import Path
 from copy import deepcopy
 
@@ -13,6 +14,16 @@
 # Placeholder stored instead of real credentials when a config is persisted
 REDACTED_PLACEHOLDER = "***REDACTED***"
 
+# Gitignored overlay file for local values, especially credentials
+LOCAL_CONFIG_NAME = "config.local.json"
+
+# Environment variables take precedence over both config files
+ENV_AUTH_VALUE = "APIPROBER_AUTH_VALUE"
+ENV_AUTH_TYPE = "APIPROBER_AUTH_TYPE"
+
+# Keys that must never be written to the tracked config.json
+SECRET_KEYS = {"auth.value"}
+
 DEFAULT_CONFIG = {
     "delay_ms": 500,
     "max_requests": 500,
@@ -51,17 +62,38 @@
 
 
 def load_config(config_path=None):
-    """Laedt Konfiguration aus JSON-Datei, merged mit Defaults."""
+    """Laedt Konfiguration aus JSON-Datei, merged mit Defaults.
+
+    Reihenfolge (spaetere Quellen ueberschreiben fruehere):
+    1. DEFAULT_CONFIG
+    2. config.json (getrackt, KEINE Secrets)
+    3. config.local.json (gitignored Overlay, z.B. auth.value)
+    4. Umgebungsvariablen APIPROBER_AUTH_VALUE / APIPROBER_AUTH_TYPE
+    """
     if config_path is None:
         config_path = BASE_DIR / "config.json"
     else:
         config_path = Path(config_path)
+    local_path = config_path.parent / LOCAL_CONFIG_NAME
 
     config = deepcopy(DEFAULT_CONFIG)
     if config_path.exists():
         with open(config_path, "r", encoding="utf-8") as f:
             user_config = json.load(f)
         _deep_merge(config, user_config)
+    if local_path.exists():
+        with open(local_path, "r", encoding="utf-8") as f:
+            local_config = json.load(f)
+        _deep_merge(config, local_config)
+
+    # Environment overrides (highest precedence, never touch any file)
+    env_auth_type = os.environ.get(ENV_AUTH_TYPE)
+    if env_auth_type:
+        config.setdefault("auth", {})["type"] = env_auth_type
+    env_auth_value = os.environ.get(ENV_AUTH_VALUE)
+    if env_auth_value:
+        config.setdefault("auth", {})["value"] = env_auth_value
+
     return config
 
 
@@ -76,6 +108,46 @@ def save_config(config, config_path=None):
         json.dump(config, f, indent=4, ensure_ascii=False)
 
 
+def set_config_value(key, value, config_path=None):
+    """Setzt einen Konfigurationswert persistent (Punkt-Notation moeglich).
+
+    Secrets (SECRET_KEYS, z.B. auth.value) landen in der gitignorten
+    config.local.json, alle anderen Werte in config.json. Es wird nur die
+    jeweilige Roh-Datei geschrieben -- Defaults werden NICHT zurueckgeschrieben
+    (kein Config-Drift in der getrackten Datei).
+
+    Returns:
+        Path: Datei, in die geschrieben wurde.
+    """
+    if config_path is None:
+        config_path = BASE_DIR / "config.json"
+    else:
+        config_path = Path(config_path)
+
+    if key in SECRET_KEYS:
+        target_path = config_path.parent / LOCAL_CONFIG_NAME
+    else:
+        target_path = config_path
+
+    raw = {}
+    if target_path.exists():
+        with open(target_path, "r", encoding="utf-8") as f:
+            raw = json.load(f)
+
+    node = raw
+    parts = key.split(".")
+    for part in parts[:-1]:
+        if part not in node or not isinstance(node[part], dict):
+            node[part] = {}
+        node = node[part]
+    node[parts[-1]] = value
+
+    with open(target_path, "w", encoding="utf-8") as f:
+        json.dump(raw, f, indent=4, ensure_ascii=False)
+        f.write("\n")
+    return target_path
+
+
 def get_db_path(config=None):
     """Gibt absoluten Pfad zur DB zurueck."""
     if config is None:

test_smoke.py

@@ -238,6 +238,83 @@ def test_resume_restores_auth_value_from_current_config(self, tmp_path, monkeypa
         assert orch.config["auth"]["type"] == "bearer"
 
 
+class TestSecretConfigStorage:
+    """Regressionstests: auth.value darf nie in die getrackte config.json."""
+
+    def _ensure_package_importable(self):
+        parent_dir = str(API_PROBER_DIR.parent)
+        if parent_dir not in sys.path:
+            sys.path.insert(0, parent_dir)
+
+    def test_set_auth_value_goes_to_local_file(self, tmp_path):
+        """set_config_value('auth.value', ...) schreibt nach config.local.json."""
+        self._ensure_package_importable()
+        from ApiProber.core.config import set_config_value
+
+        cfg_path = tmp_path / "config.json"
+        cfg_path.write_text('{"delay_ms": 100}\n', encoding="utf-8")
+
+        written = set_config_value("auth.value", "my-token", config_path=cfg_path)
+
+        assert written.name == "config.local.json"
+        assert "my-token" not in cfg_path.read_text(encoding="utf-8"), \
+            "Secret darf nicht in config.json landen"
+        local = json.loads((tmp_path / "config.local.json").read_text(encoding="utf-8"))
+        assert local["auth"]["value"] == "my-token"
+
+    def test_set_normal_value_goes_to_config_json(self, tmp_path):
+        """Nicht-Secrets gehen weiterhin in config.json, ohne Default-Drift."""
+        self._ensure_package_importable()
+        from ApiProber.core.config import set_config_value
+
+        cfg_path = tmp_path / "config.json"
+        cfg_path.write_text('{"delay_ms": 100}\n', encoding="utf-8")
+
+        written = set_config_value("delay_ms", 250, config_path=cfg_path)
+
+        assert written == cfg_path
+        raw = json.loads(cfg_path.read_text(encoding="utf-8"))
+        assert raw == {"delay_ms": 250}, \
+            "Nur Roh-Werte schreiben, keine gemergten Defaults (Config-Drift)"
+
+    def test_local_config_overlays_config_json(self, tmp_path, monkeypatch):
+        """config.local.json ueberlagert config.json beim Laden."""
+        self._ensure_package_importable()
+        from ApiProber.core.config import load_config
+
+        monkeypatch.delenv("APIPROBER_AUTH_VALUE", raising=False)
+        monkeypatch.delenv("APIPROBER_AUTH_TYPE", raising=False)
+
+        cfg_path = tmp_path / "config.json"
+        cfg_path.write_text('{"delay_ms": 100}\n', encoding="utf-8")
+        (tmp_path / "config.local.json").write_text(
+            '{"auth": {"type": "bearer", "value": "local-secret"}}\n',
+            encoding="utf-8"
+        )
+
+        config = load_config(cfg_path)
+        assert config["delay_ms"] == 100
+        assert config["auth"]["type"] == "bearer"
+        assert config["auth"]["value"] == "local-secret"
+
+    def test_env_var_overrides_all_config_files(self, tmp_path, monkeypatch):
+        """APIPROBER_AUTH_VALUE hat Vorrang vor config.json und config.local.json."""
+        self._ensure_package_importable()
+        from ApiProber.core.config import load_config
+
+        cfg_path = tmp_path / "config.json"
+        cfg_path.write_text('{}\n', encoding="utf-8")
+        (tmp_path / "config.local.json").write_text(
+            '{"auth": {"value": "file-secret"}}\n', encoding="utf-8"
+        )
+        monkeypatch.setenv("APIPROBER_AUTH_VALUE", "env-secret")
+        monkeypatch.setenv("APIPROBER_AUTH_TYPE", "api_key")
+
+        config = load_config(cfg_path)
+        assert config["auth"]["value"] == "env-secret"
+        assert config["auth"]["type"] == "api_key"
+
+
 class TestRobotsServerError:
     """Regressionstest: 5xx beim robots.txt-Abruf darf NICHT 'alles erlaubt' bedeuten."""