feat(security): block credentials from reaching the LLM via prompt secret scan

Prompts were sent to the model with no secret scan, so a pasted API key would leak to the LLM. Added findSecretInPrompt in @bmm/types (tight provider-key patterns: Anthropic/OpenAI/GitHub/AWS/Google/Slack/Stripe/JWT/private-key) shared by both sides. The web wizard blocks before sending with a clear message; the API preview and preview-stream endpoints reject with secret_in_prompt as the hard guarantee. Credential VALUES already never touched the model - they are entered in the separate encrypted step 2; this closes the remaining leak path where a user pastes a key into the prompt itself.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/routes/servers.ts

@@ -28,6 +28,7 @@ import {
   IterateServerInput,
   PreviewInput,
   type SpecEdit,
+  findSecretInPrompt,
 } from '@bmm/types';
 import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
@@ -62,6 +63,16 @@ export async function serverRoutes(app: FastifyInstance): Promise<void> {
     if (!parsed.success) {
       return reply.code(400).send({ error: 'invalid_input', issues: parsed.error.flatten() });
     }
+    // Never let a credential reach the LLM. Reject prompts that contain a
+    // real-looking key/token before the model call. (Values belong in the
+    // separate encrypted credential fields, not the prompt.)
+    const leakedSecret = findSecretInPrompt(parsed.data.prompt);
+    if (leakedSecret) {
+      return reply.code(400).send({
+        error: 'secret_in_prompt',
+        detail: `Your prompt looks like it contains ${leakedSecret}. Remove it — API keys must never go in the prompt (it is sent to the AI model). You will add credentials in their own encrypted fields after the spec is generated.`,
+      });
+    }
 
     const billing = await getOrgBilling(user.orgId);
     if (billing.suspended) {
@@ -190,6 +201,16 @@ export async function serverRoutes(app: FastifyInstance): Promise<void> {
     if (!parsed.success) {
       return reply.code(400).send({ error: 'invalid_input', issues: parsed.error.flatten() });
     }
+    // Never let a credential reach the LLM. Reject prompts that contain a
+    // real-looking key/token before the model call. (Values belong in the
+    // separate encrypted credential fields, not the prompt.)
+    const leakedSecret = findSecretInPrompt(parsed.data.prompt);
+    if (leakedSecret) {
+      return reply.code(400).send({
+        error: 'secret_in_prompt',
+        detail: `Your prompt looks like it contains ${leakedSecret}. Remove it — API keys must never go in the prompt (it is sent to the AI model). You will add credentials in their own encrypted fields after the spec is generated.`,
+      });
+    }
 
     const billing = await getOrgBilling(user.orgId);
     if (billing.suspended) {

apps/web/app/(dashboard)/servers/new/page.tsx

@@ -6,6 +6,7 @@ import { InstallSnippets } from '@/components/install-snippets';
 import { StreamingLogs } from '@/components/streaming-logs';
 import { Button } from '@/components/ui/button';
 import { apiFetch, apiSseStream } from '@/lib/api';
+import { findSecretInPrompt } from '@bmm/types';
 import { Loader2, RotateCcw, X } from 'lucide-react';
 import Link from 'next/link';
 import { useRouter, useSearchParams } from 'next/navigation';
@@ -240,6 +241,16 @@ function NewServerPageInner() {
       setError('Name and slug are required.');
       return;
     }
+    // Keep credentials out of the model: block a prompt that contains a real
+    // key/token before it is ever sent. Credentials go in the encrypted fields
+    // in the next step, never in the prompt.
+    const leaked = findSecretInPrompt(prompt);
+    if (leaked) {
+      setError(
+        `Looks like your prompt contains ${leaked}. Remove it — API keys must never go in the prompt (it is sent to the AI). You'll add credentials in their own encrypted fields in the next step.`,
+      );
+      return;
+    }
     setStep('analyzing');
 
     // Streaming preview: pipes Anthropic's token deltas back as SSE. Cloudflare's