SUM-SEC-15 [P1][15/20][Med] Tighten secret scrubbing and refuse dangerous prod debug

[CHINMAYVIVEK]

ID: SUM-SEC-15
Wave: P1
Severity: Medium
Labels: security, logging, secrets, P1, medium
Branch: fix/SUM-SEC-15-scrub-dev-sql-secure-cookies
Languages: Go
CWE: CWE-532 / CWE-614

Summary

• dev_features=sql logs SQL args; scrub often lacks field names → positional secrets leak.
• Scrub keyword gaps (bearer, credential, private_key, refresh, …).
• Session Secure: !DevMode — dev_mode=true in a “prod” deployment disables Secure cookies (warned, still dangerous).

Acceptance criteria

• Refuse enabling sql / verbose access logging unless DevMode (or explicit dangerous flag with loud stderr)
• Expand IsSecretKey / keyword list; scrub known secret-shaped values in SQL arg lists
• Prefer force_secure_cookies / TLS detection over sole !DevMode for Secure
• Tests for scrub keywords + boot refusal

Files to check / change

• sumeru/core/applog/scrub.go
• sumeru/core/orm/db_dev_log.go
• sumeru/core/orm/dev_features.go
• sumeru/core/server/web/auth_session.go (cookie Secure)
• sumeru/core/server/config/