[BUG] pg deploy exposes internal sudo.personhood.dev URLs in errors (security/UX)

[ottovlotto]

Severity: P0
Reported by: DevEx Audit External
Source: DevEx Audit (External), 3 June 2026

Symptom

Deploying #1
Critical Security/UX: Exposure of https://sudo.personhood.dev/personhood-faucet and https://sudo.personhood.dev/dotns-bootstrap URLs when error
$pg deploy
Fix as top priority and make it transparent for the user.
❌Mac OS X, ❌Ubuntu 26.04 LTS

When pg deploy errors out, the CLI exposes internal sudo URLs (https://sudo.personhood.dev/personhood-faucet and https://sudo.personhood.dev/dotns-bootstrap) directly to the end user. Auditor flagged this as a security/UX issue — those are internal bootstrap endpoints not intended for public consumption.

Per audit Appendix CLI screenshots: "sudo.personhood.dev doesn't look like a place to visit for regular users."

Reproduction

DOT_DEPLOY_VERBOSE=1 DOT_MEMORY_TRACE=1 pg deploy 2> >(tee dot.log >&2)

with a signer that's not yet ProofOfPersonhoodFull. Observe the error message includes the two sudo URLs.

Recommended fix / next steps

• Stop surfacing internal sudo URLs to end users. The PoP-bootstrap recipe should be wrapped in CLI commands or hidden behind official tooling.
• Replace the error with a user-friendly message: "Your account needs full Proof-of-Personhood to deploy. Open the Polkadot mobile app and complete attestation." Optionally automate via playground bootstrap command.
• Cross-ref playground-cli [BUG] CLI surfaces upstream PoP error unchanged — ~100 words, ~4 services, unrecoverable #213 (CLI surfaces upstream PoP error unchanged) — overlapping but auditor specifically called out the URL exposure as a distinct security/UX concern.
• Cross-ref user memory note "Funder PoP bootstrap recipe" — the manual recipe should not leak to users.

[ottovlotto]

Automated comment: related to #213 (CLI surfaces upstream PoP error unchanged). The sudo URL exposure is the security/UX facet of the same opaque error block — fixing the curated message in #213 should remove these URLs from user-visible output.