OpenHands 1.7.0 moves WebSocket auth off the URL

OpenHands shipped a fix on July 29 that moves WebSocket authentication out of the URL, per the project's 1.7.0 release notes.

That closes a leak agent-UI builders routinely underestimate: a token sitting in the URL travels wherever the URL travels, into proxy logs and browser history. Referrer headers can carry it too, handing a live session to whoever reads them next.

It's a common failure mode in agent UIs that stream over sockets, per the release notes, and worth checking for in your own code.

The fix lands under PR #16095, per the release notes, which don't say where the credentials moved to, only that they're off the URL.

1.7.0 also adds a persistent agent memory toggle and makes LLM selection always visible in the interface, changes aimed at daily use rather than security.

Check your own agent UI's socket connection before you worry about anyone else's. Open the network tab, look at the WebSocket URL, and see if the auth token sits in the query string. It's a five-minute audit against a leak that shows up in logs you don't control.