🛡️ Sentinel: [MEDIUM] Fix exception string leakage in HTTP responses

[socialawy-dev]

🚨 Severity: MEDIUM
💡 Vulnerability: The raw string representation of caught internal exceptions (Exception as e) was being exposed directly to clients inside HTTP 500 responses (specifically raise HTTPException(status_code=500, detail=f"Upload failed: {e}")).
🎯 Impact: Exposing internal exception strings can leak sensitive application state, stack details, or potentially infrastructure specifics (like file paths or database queries) to external users, enabling reconnaissance for further attacks.
🔧 Fix: Modified the catch block in the ingest route to log the exception internally using logger.error and return a generic, static message ("Upload failed") to the client, following the "fail securely" principle.
✅ Verification:

1. Run uv run ruff check to ensure formatting.
2. Run uv run pytest tests/ to ensure no functionality is broken.
3. Review src/audioformation/server/routes.py around line 188 to ensure logger.error is used and HTTPException returns a generic string.

---

PR created automatically by Jules for task 15755530580267129863 started by @socialawy

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request addresses a security vulnerability by preventing raw exception strings from leaking to clients in API responses. In src/audioformation/server/routes.py, the exception is now logged internally, and a generic error message is returned. Additionally, the .jules/sentinel.md documentation is updated, and dependency constraints for mypy and ruff are bumped in uv.lock. The reviewer suggested using logger.exception instead of logger.error to ensure the full traceback is preserved in the logs for easier debugging.

[gemini-code-assist]

When logging caught exceptions, using logger.error with only the exception string representation ({e}) discards the traceback, which makes debugging production issues difficult. Using logger.exception instead will automatically include the traceback in the log output at the ERROR level.

Suggested change

	logger.error(f"Upload failed for project {project_id}: {e}")
	logger.exception(f"Upload failed for project {project_id}")