**RESOLVED 2026-07-12 (w6 follow-ups).** APIError.Error() returns the status only — the upstream response body is no longer interpolated, so GitHub's verbatim 4xx/5xx text can't reach a bex API caller. The body stays on the struct for internal use.

# Collapse GitHub upstream error body in responses — from w6/m6/t005 (secrets hygiene)

`lego/backend/internal/github/client.go:123` — `APIError.Error()` interpolates
the raw upstream response body: `fmt.Sprintf("github: unexpected status %d: %s",
e.Status, e.Body)`. 4xx `APIError`s are flattened to `core.ErrBadRequest`
(dropping the body) by `mapGitHubErr` before reaching a caller, but 5xx
`APIError`s pass through `core.WriteErr` (`core/http.go`), so GitHub's raw 5xx
body reaches the API caller.

No bex credential is in that body — tokens appear only on 2xx from
`/access_tokens`. This is **upstream-error-text disclosure**, not a credential
leak. Still worth closing: collapse 5xx to a fixed `core.Err("github upstream
error")` (or truncate `e.Body`) so bex never forwards GitHub's verbatim error
text to its own callers.

Source: w6/m6/t005 secrets-hygiene audit, 2026-07-11.
