httpx logs the full request URL at INFO; the Gemini API authenticates via ?key=AIzaSy..., so describe.log and transcribe.log on Google-provider installs were getting live keys written in cleartext on every API call. Set the httpx logger to WARNING at package import time so the level survives every downstream basicConfig() call across cortex, supervisor, link, talents, and the observer CLIs that go through setup_cli. Bumps version 0.3.7 -> 0.3.8 and adds a non-routine CHANGELOG entry (security / data-handling — gated for founder review at publish time per cmo/brand/changelog-voice.md sensitive-changes rule). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>