Outbound calls that carry secrets can't be kept away from Manifest on the client side #40

While preparing to install the SDK in a production CakePHP app, the team stopped before merging because of what the SDK would do with their outbound calls. Most of those calls carry secrets:

• OAuth token exchanges (authorization code grant: code, code_verifier, redirect_uri in a form body)
• a mail provider API (key in a Basic auth header)
• Slack and customer webhooks (the secret is part of the URL path)
• an analytics API

Their concern: the SDK captures these requests, sends them to a third party, and can replay or rewrite them (4xx → 2xx). The app is sold as an evidence-based product, so this is a trust decision they have to be able to defend, and today they can't make that guarantee from their own code.

What goes out today

• Every call, even a successful one: the path is sent as is (CONTRACT.md, "Tracked requests": "a secret embedded in a path (a webhook URL, /bot<token>/) is sent"). So every Slack webhook call sends its secret, even when it works.
• Every healable 4xx: headers (credential names masked), the body minus top-level credential-named keys, and the raw error response, unmasked. code and code_verifier are not in Wire::SECRET_PARAMS, so a failed authorization code exchange sends a live, single-use grant.
• Retry: a healed request is sent again automatically. For a token exchange or a webhook to a customer, an automatic rewritten retry changes the app's behaviour, which some teams won't accept.

The guide says "everything that is policy lives server-side". For this case that's the wrong place: the team needs the guarantee to hold in code they control, before anything leaves the machine.

Suggestion

1. Client-side exclusion: manifest(exclude: [...]) / MNFST_EXCLUDE listing hosts or host/path-prefix patterns (hooks.slack.com, */oauth/token). An excluded call is not tracked, not captured and never retried.
2. Observe-only mode: capture and report, but never retry or rewrite (MNFST_HEAL=off or similar), so a team can start without handing over control of its responses.
3. Path redaction for tracked calls: mask path segments that look like secrets (long random tokens), or at least for known webhook hosts.
4. Mask OAuth grant fields: withhold code and code_verifier when the body carries a grant_type.
5. Document it in one place: a short README table of what leaves the machine, per call type (tracked / healable failure / retry), and how to exclude a call.