Security fixes: B310, B324, B110 (bandit scan)

[lawrencel1ng]

Automated security fixes from cron job:

• B324: Weak MD5 hash → added usedforsecurity=False
• B310: Unsafe urlopen → added URL scheme validation
• B110: Bare except/pass → replaced with logger.debug() calls

All tests pass.

[nesquena-hermes]

Review: Security fixes — B310, B324, B110 (bandit scan)

Thanks for this! All three bandit findings are addressed correctly. Here's the breakdown:

---

✅ B324 — MD5 usedforsecurity=False (gateway_watcher.py)

return hashlib.md5(key.encode(), usedforsecurity=False).hexdigest()

Correct fix. The MD5 here is used purely for change-detection hashing (snapshot comparison), not for any security purpose. The usedforsecurity=False flag is the right suppression — it tells bandit and FIPS-mode Python that this is intentional.

---

✅ B310 — URL scheme validation (config.py, bootstrap.py)

if parsed_url.scheme not in ("", "http", "https"):
    raise ValueError(f"Invalid URL scheme: {parsed_url.scheme}")

Good approach. Validating the scheme before calling urlopen is the correct pattern. The # nosec B310 annotation is appropriate because the runtime guard precedes each call.

One small note: In config.py the scheme check runs on a URL that may have had http:// prepended (endpoint_url if "://" in endpoint_url else f"http://{endpoint_url}"). After the prepend, the scheme will always be http or https if the raw input had :// in it — the validation still holds, just worth being aware of.

---

✅ B110 — Bare except: pass → logger.debug() (all modules)

All silent swallows replaced with logger.debug() calls. This is a quality improvement beyond just silencing bandit — it makes the error paths observable during troubleshooting without adding noise to production logs.

The QuietHTTPServer addition in server.py is a nice companion fix — it stops the ConnectionResetError log spam that happens when clients disconnect abruptly, which is separate from the B110 fixes but improves the signal-to-noise ratio in logs.

---

Tests

The PR description says all tests pass. No new tests added for these changes, which is appropriate — these are mechanical substitutions with no behavior change (debug logging is no-op at default log levels, and the URL scheme check throws on inputs that would have caused urlopen to fail anyway).

---

Summary

Finding	Fix	Status
B324 (MD5 hash)	usedforsecurity=False	✅ Correct
B310 (unsafe urlopen)	Scheme validation + # nosec	✅ Correct
B110 (bare except/pass)	logger.debug() replacements	✅ Correct
Bonus: connection reset spam	QuietHTTPServer	✅ Good addition

Looks good to me — clean, targeted fixes with no behavior regressions.

[nesquena-hermes]

Closed in favor of #361 which merged this fix rebased onto master (resolved api/profiles.py conflict with v0.50.12 env isolation), fixed traceback.sys.exc_info() → sys.exc_info(), and added 19 tests (test_sprint43.py). 841 tests pass on master.