Directus's webhook trigger flows can leak sensitive data
Describe the BugIn Directus, when a **Flow** with the "_Webhook_" trigger and the "_Data of Last Operation_" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.![Image](https://github.com/user-attachments/assets/fb894347-cd10-4e79-9469-8fc1b2289794)
![Image](https://github.com/user-attachments/assets/a20337a2-005f-4cfd-ba30-fc5f579ed6c4)
![Image](https://github.com/user-attachments/assets/9b776248-4a20-46f0-92a4-3760d8e53df9)To Reproduce**Steps to Reproduce:**Create a Flow in Directus with:Trigger: WebhookResponse Body: Data of Last OperationAdd a condition that is likely to fail.Trigger the Flow with any input data that will fail the condition.Observe the API response, which includes sensitive information like:Environmental variables (`$env`)Authorization headersUser details under `$accountability`Previous operational data.**Expected Behavior:**
In the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.**Actual Behavior:**
The API response includes sensitive information such as:Environment keys (`FLOWS_ENV_ALLOW_LIST`)User accountability (`role`, `user`, etc.)Operational logs (`current_payments`, `$last`), which might contain private details.