Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-openhands-canvas-removes-the-session-key-from-a-child-command-line-only-after-v1-33
Canvas removes the session key from a child command line only after v1.33.0. The launcher stops passing the static server’s session key as a command-line argument and uses a child environment value instead. The key therefore leaves that process-argument surface. This patch is after the latest stable release. It does not remove the automation-key alias from agent terminals or correct the Docker custom-key export branch.
Channel: main-unreleased. Half: defect. Date: 2026-10-23.
Operator consequence: Track the first containing release and inspect the launched process arguments before closing this exposure path. Do not promise the repair from an ordinary v1.33.0 upgrade. Moving a credential between process surfaces reduces one disclosure path; acceptance still requires checking which subprocesses inherit it.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openhands-canvas-removes-the-session-key-from-a-child-command-line-only-after-v1-33
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openhands-canvas-removes-the-session-key-from-a-child-command-line-only-after-v1-33github.com/OpenHands/OpenHands/commit/8fdd6859aee5779ebbc12e44dc32823d7cb08527git compare2026-10-24-openhands-canvas-removes-the-session-key-from-a-child-command-line-only-after-v1-33github.com/OpenHands/OpenHands/compare/v1.33.0...fee10e3d2909ebbf9950578575b1ee011492171e
Versioned source: run artifact