Enterprise API has no edge allowlist: supplier disclosure rests on a denylist that cannot hold #82

Problem

api.helmcode.com has no edge normaliser. Supplier-header disclosure there is defended by a Traefik denylist only, and a denylist with no wildcard support cannot hold.

This is not theoretical. On 2026-09-15, with the list already at 148 entries, a live enterprise key on glm5.3 got back 14 uncovered headers on a 200, including llm_provider-x-fusion-transport: embedded — "fusion" is Novita's own stack vocabulary, so the header named the supplier outright. PR #368 adds those 14 plus 2 prophylactic spellings. It closes today's leak and nothing about tomorrow's.

api.nan.builders does not have this problem: the Cloudflare Worker nan-api-edge-normaliser applies a header allowlist, so an unforeseen supplier header is dropped by default. wrangler.jsonc routes only api.nan.builders.

Three reviewers of #368 landed on the same conclusion independently: the denylist is the sole defence for enterprise, and no test in the repo can catch an unforeseen spelling — a Traefik denylist makes it invisible by construction.

What to do

Put an allowlist in front of api.helmcode.com, reusing cloudflare/api-edge-normaliser/. Points that already cost time on the community side and are written up in the memory note on the three disclosure layers:

• The Worker must not read 2xx bodies. That is what keeps streaming safe.
• Rollback is npx wrangler delete <name> and takes seconds; degrading to "clean everywhere except audio" is the failure mode, not "no protection".
• Enterprise routes differ from community's: /v1/rerank, /v2/rerank and /v1/responses are in the enterprise ingress. Check the full path list in kubernetes/apps/prod/nan-enterprise/litellm/litellm-enterprise/values.yaml before assuming community's route glob transfers.
• Keep retry-after, retry-after-ms, x-should-retry, x-request-id. Drop every x-ratelimit-* spelling: after #368 that family is stripped upstream and re-admitting any of it at the edge would restate a policy the platform no longer follows.

Smaller, related

Bare x-ratelimit-reset and llm_provider-x-ratelimit-reset are in neither the Traefik denylist nor (after #368) the Worker allowlist. Community drops them by default; enterprise would forward them if a supplier ever emitted them at the top level. Least disclosive member of the family, never observed, two lines to close.

Acceptance

A header no one has listed anywhere, emitted by a supplier, does not reach a caller on api.helmcode.com.