fix: make trace_include_sensitive_data secure by default

docs/tracing.md

@@ -85,7 +85,7 @@ The `generation_span()` stores the inputs/outputs of the LLM generation, and `fu
 
 Similarly, Audio spans include base64-encoded PCM data for input and output audio by default. You can disable capturing this audio data by configuring [`VoicePipelineConfig.trace_include_sensitive_audio_data`][agents.voice.pipeline_config.VoicePipelineConfig.trace_include_sensitive_audio_data].
 
-By default, `trace_include_sensitive_data` is `True`. You can set the default without code by exporting the `OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA` environment variable to `true/1` or `false/0` before running your app.
+By default, `trace_include_sensitive_data` is `False`. You can set the default without code by exporting the `OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA` environment variable to `true/1` or `false/0` before running your app.
 
 ## Custom tracing processors
 

src/agents/run_config.py

@@ -29,7 +29,7 @@
 
 def _default_trace_include_sensitive_data() -> bool:
     """Return the default for trace_include_sensitive_data based on environment."""
-    val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "true")
+    val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "false")
     return val.strip().lower() in ("1", "true", "yes", "on")
 
 

tests/mcp/test_mcp_tracing.py

@@ -61,7 +61,6 @@ async def test_mcp_tracing():
                                 "type": "function",
                                 "data": {
                                     "name": "test_tool_1",
-                                    "input": "",
                                     "output": "{'type': 'text', 'text': 'result_test_tool_1_{}'}",  # noqa: E501
                                     "mcp_data": {"server": "fake_mcp_server"},
                                 },
@@ -122,17 +121,12 @@ async def test_mcp_tracing():
                         "children": [
                             {
                                 "type": "function",
-                                "data": {
-                                    "name": "non_mcp_tool",
-                                    "input": "",
-                                    "output": "tool_result",
-                                },
+                                "data": {"name": "non_mcp_tool"},
                             },
                             {
                                 "type": "function",
                                 "data": {
                                     "name": "test_tool_2",
-                                    "input": "",
                                     "output": "{'type': 'text', 'text': 'result_test_tool_2_{}'}",  # noqa: E501
                                     "mcp_data": {"server": "fake_mcp_server"},
                                 },
@@ -196,7 +190,6 @@ async def test_mcp_tracing():
                                 "type": "function",
                                 "data": {
                                     "name": "test_tool_3",
-                                    "input": "",
                                     "output": "{'type': 'text', 'text': 'result_test_tool_3_{}'}",  # noqa: E501
                                     "mcp_data": {"server": "fake_mcp_server"},
                                 },

tests/test_run_config.py

@@ -88,11 +88,11 @@ async def test_agent_model_object_is_used_when_present() -> None:
     assert result.final_output == "from-agent-object"
 
 
-def test_trace_include_sensitive_data_defaults_to_true_when_env_not_set(monkeypatch):
-    """By default, trace_include_sensitive_data should be True when the env is not set."""
+def test_trace_include_sensitive_data_defaults_to_false_when_env_not_set(monkeypatch):
+    """By default, trace_include_sensitive_data should be False when the env is not set."""
     monkeypatch.delenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", raising=False)
     config = RunConfig()
-    assert config.trace_include_sensitive_data is True
+    assert config.trace_include_sensitive_data is False
 
 
 @pytest.mark.parametrize(

tests/test_tracing_errors.py

@@ -13,6 +13,7 @@
     InputGuardrail,
     InputGuardrailTripwireTriggered,
     MaxTurnsExceeded,
+    RunConfig,
     RunContextWrapper,
     Runner,
     TResponseInputItem,
@@ -92,7 +93,11 @@ async def test_multi_turn_no_handoffs():
     )
 
     with pytest.raises(ValueError):
-        await Runner.run(agent, input="first_test")
+        await Runner.run(
+            agent,
+            input="first_test",
+            run_config=RunConfig(trace_include_sensitive_data=True),
+        )
 
     assert fetch_normalized_spans() == snapshot(
         [
@@ -149,7 +154,11 @@ async def test_tool_call_error():
         ]
     )
 
-    result = await Runner.run(agent, input="first_test")
+    result = await Runner.run(
+        agent,
+        input="first_test",
+        run_config=RunConfig(trace_include_sensitive_data=True),
+    )
 
     tool_outputs = [item for item in result.new_items if item.type == "tool_call_output_item"]
     assert tool_outputs, "Expected a tool output item for invalid JSON"
@@ -232,7 +241,11 @@ async def test_multiple_handoff_doesnt_error():
             [get_text_message("done")],
         ]
     )
-    result = await Runner.run(agent_3, input="user_message")
+    result = await Runner.run(
+        agent_3,
+        input="user_message",
+        run_config=RunConfig(trace_include_sensitive_data=True),
+    )
     assert result.last_agent == agent_1, "should have picked first handoff"
 
     assert fetch_normalized_spans() == snapshot(
@@ -367,7 +380,11 @@ async def test_handoffs_lead_to_correct_agent_spans():
             [get_text_message("done")],
         ]
     )
-    result = await Runner.run(agent_3, input="user_message")
+    result = await Runner.run(
+        agent_3,
+        input="user_message",
+        run_config=RunConfig(trace_include_sensitive_data=True),
+    )
 
     assert result.last_agent == agent_3, (
         f"should have ended on the third agent, got {result.last_agent.name}"
@@ -475,7 +492,12 @@ async def test_max_turns_exceeded():
     )
 
     with pytest.raises(MaxTurnsExceeded):
-        await Runner.run(agent, input="user_message", max_turns=2)
+        await Runner.run(
+            agent,
+            input="user_message",
+            max_turns=2,
+            run_config=RunConfig(trace_include_sensitive_data=True),
+        )
 
     assert fetch_normalized_spans() == snapshot(
         [

tests/test_tracing_errors_streamed.py

@@ -16,6 +16,7 @@
     MaxTurnsExceeded,
     OutputGuardrail,
     OutputGuardrailTripwireTriggered,
+    RunConfig,
     RunContextWrapper,
     Runner,
     TResponseInputItem,
@@ -98,7 +99,11 @@ async def test_multi_turn_no_handoffs():
     )
 
     with pytest.raises(ValueError):
-        result = Runner.run_streamed(agent, input="first_test")
+        result = Runner.run_streamed(
+            agent,
+            input="first_test",
+            run_config=RunConfig(trace_include_sensitive_data=True),
+        )
         async for _ in result.stream_events():
             pass
 
@@ -158,7 +163,11 @@ async def test_tool_call_error():
         ]
     )
 
-    result = Runner.run_streamed(agent, input="first_test")
+    result = Runner.run_streamed(
+        agent,
+        input="first_test",
+        run_config=RunConfig(trace_include_sensitive_data=True),
+    )
     async for _ in result.stream_events():
         pass
 
@@ -243,7 +252,11 @@ async def test_multiple_handoff_doesnt_error():
             [get_text_message("done")],
         ]
     )
-    result = Runner.run_streamed(agent_3, input="user_message")
+    result = Runner.run_streamed(
+        agent_3,
+        input="user_message",
+        run_config=RunConfig(trace_include_sensitive_data=True),
+    )
     async for _ in result.stream_events():
         pass
 
@@ -380,7 +393,11 @@ async def test_handoffs_lead_to_correct_agent_spans():
             [get_text_message("done")],
         ]
     )
-    result = Runner.run_streamed(agent_3, input="user_message")
+    result = Runner.run_streamed(
+        agent_3,
+        input="user_message",
+        run_config=RunConfig(trace_include_sensitive_data=True),
+    )
     async for _ in result.stream_events():
         pass
 
@@ -485,7 +502,12 @@ async def test_max_turns_exceeded():
     )
 
     with pytest.raises(MaxTurnsExceeded):
-        result = Runner.run_streamed(agent, input="user_message", max_turns=2)
+        result = Runner.run_streamed(
+            agent,
+            input="user_message",
+            max_turns=2,
+            run_config=RunConfig(trace_include_sensitive_data=True),
+        )
         async for _ in result.stream_events():
             pass