feat(web-ai): render markdown answers safely

backend/ruoyi-common/ruoyi-common-core/src/main/java/org/dromara/common/core/constant/SystemConstants.java

@@ -85,7 +85,7 @@ public interface SystemConstants {
     /**
      * 排除敏感属性字段
      */
-    String[] EXCLUDE_PROPERTIES = { "password", "oldPassword", "newPassword", "confirmPassword" };
+    String[] EXCLUDE_PROPERTIES = { "password", "oldPassword", "newPassword", "confirmPassword", "apiKey", "api_key" };
 
 
 }

backend/ruoyi-modules/ruoyi-aihr/src/test/java/org/dromara/aihr/webai/AihrWebAiSecurityTest.java

@@ -8,6 +8,7 @@ import org.dromara.aihr.webai.AihrWebSearchClient.SearchResult;
 import org.dromara.aihr.webai.AihrWebSearchClient.WebSource;
 import org.dromara.aihr.webai.AihrWebSearchProviderService.ProviderRequest;
 import org.dromara.aihr.webai.AihrWebSearchProviderService.RuntimeProvider;
+import org.dromara.common.core.constant.SystemConstants;
 import org.dromara.common.core.exception.ServiceException;
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
@@ -54,6 +55,13 @@ class AihrWebAiSecurityTest {
         assertFalse(mapper.writeValueAsString(request).contains("must-not-reach-logs"));
     }
 
+    @Test
+    @Tag("dev")
+    void requestLogMasksProviderApiKeys() {
+        assertTrue(List.of(SystemConstants.EXCLUDE_PROPERTIES).contains("apiKey"));
+        assertTrue(List.of(SystemConstants.EXCLUDE_PROPERTIES).contains("api_key"));
+    }
+
     @Test
     @Tag("dev")
     void searchEndpointRejectsLocalAndPrivateNetworks() {