Imported from the byteflow.tools deep audit on 2026-06-22.
Problem: Pipeline Builder states that save/export/share keep workflow structure and public options only, but this privacy boundary is easy to miss. Because recipes often handle logs, JWTs, JSON payloads, and URL-encoded data, users need strong confirmation that runtime input, outputs, logs, and secrets are excluded.
Affected URL:
Reproduction steps:
- Open /en/pipeline-builder.
- Use a built-in recipe such as Security token review or Log scrub before sharing.
- Paste dummy sensitive-looking input.
- Run the recipe.
- Click Save, Export JSON, and Share URL.
- Inspect exported JSON, generated URL, localStorage, and sessionStorage for runtime input.
Expected behavior: before saving, exporting, or sharing, the UI should explicitly show what is included and excluded. The user should see that only step configuration and public options are shared.
Actual behavior: the privacy note exists, but it is not prominent enough at the exact moment the user shares or exports a recipe.
Impact: users may avoid the feature because they distrust sharing, or worse, they may share without understanding the boundary. This weakens the core privacy-first promise.
Proposed fix:
- Add a pre-share confirmation panel listing included fields and excluded fields.
- Add a “Privacy preview” drawer that shows the exact JSON payload before export/share.
- Ensure runtime input, final output, run log, and constant step input are stripped by tests.
- Add warnings when step option values appear sensitive.
- Add documentation explaining share URL semantics.
Acceptance criteria:
- Export JSON and Share URL actions show a clear privacy preview.
- Automated tests prove runtime input/output/log content is absent.
- localStorage does not persist sensitive runtime data by default.
- Share URLs remain valid and contain only recipe structure/options.
- The UI clearly states “runtime input is excluded” beside the share action.
Imported from the byteflow.tools deep audit on 2026-06-22.
Problem: Pipeline Builder states that save/export/share keep workflow structure and public options only, but this privacy boundary is easy to miss. Because recipes often handle logs, JWTs, JSON payloads, and URL-encoded data, users need strong confirmation that runtime input, outputs, logs, and secrets are excluded.
Affected URL:
Reproduction steps:
Expected behavior: before saving, exporting, or sharing, the UI should explicitly show what is included and excluded. The user should see that only step configuration and public options are shared.
Actual behavior: the privacy note exists, but it is not prominent enough at the exact moment the user shares or exports a recipe.
Impact: users may avoid the feature because they distrust sharing, or worse, they may share without understanding the boundary. This weakens the core privacy-first promise.
Proposed fix:
Acceptance criteria: