Skip to content

Security: redact query strings + WS payloads from logs#206

Closed
its-DeFine wants to merge 1 commit intocloudflare:mainfrom
its-DeFine:codex/redact-secrets-in-logs-20260208
Closed

Security: redact query strings + WS payloads from logs#206
its-DeFine wants to merge 1 commit intocloudflare:mainfrom
its-DeFine:codex/redact-secrets-in-logs-20260208

Conversation

@its-DeFine
Copy link
Copy Markdown

Redacts sensitive data from worker logs:

  • Never log URL query strings (often contain ?token=... / ?secret=...)
  • Stop logging WebSocket message payloads (may contain auth + user content)
  • CDP route: avoid logging request params

Motivation: prevent accidental credential leakage via logs.

PetrAnto referenced this pull request in PetrAnto/moltworker Feb 24, 2026
…lock

- Bump openclaw 2026.2.3 → 2026.2.6-3 in Dockerfile (upstream PR #204)
- Add redactWsPayload() to sanitize sensitive fields (api_key, token,
  auth, etc.) from WebSocket debug logs (upstream PR #206)
- Add container-level lock file to prevent concurrent R2 sync operations,
  with 5-min stale lock cleanup (upstream PRs #199, #202)
- Add logging.test.ts for redaction utilities

https://claude.ai/code/session_01K2mQTABDGY7DnnposPdDjw
@andreasjansson
Copy link
Copy Markdown
Member

Superseded by PR #133 (merged Feb 2), which implemented query param redaction and gated WS payload logging behind DEBUG_ROUTES. The functionality you proposed is already in main. Thank you for the contribution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants