fix(transport): redact tokens from RPC debug logs; 1.0.2 - #22
Merged
Conversation
token.js's _corePost() and http.js's _logRpcRequest/_logRpcResponse log full request/response bodies to stdout by default (COCO_RPC_LOG defaults ON). On the auth endpoints (/auth/agent/token, /auth/refresh, /auth/ws-ticket) the body IS the access_token/refresh_token pair, so this put live credentials in plaintext into any consumer's process logs. Bodies are now passed through a new redactSecrets() helper (src/transport/redact.js) before logging — replaces known-sensitive field names (access_token, refresh_token, id_token, api_key, client_secret, password, secret, ticket) with [REDACTED]. Log structure/status/non-sensitive fields (incl. *_expires_at timestamps, useful for debugging expiry) are unchanged; the logging toggle itself is untouched. Found while auditing the identical pattern in zylos-openmax (which vendors this same corePost/RPC-logging shape) after another team reported it leaking tokens into their PM2 logs. This SDK doesn't persist tokens to disk itself (that's left to each consumer), so the log leak is the only instance of this bug here. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
zylos0t
approved these changes
Jul 29, 2026
4 tasks
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
token.js's_corePost()andhttp.js's_logRpcRequest/_logRpcResponselog full request/response bodies to stdout by default (COCO_RPC_LOGdefaults ON). On the auth endpoints the body IS theaccess_token/refresh_tokenpair, so this put live credentials in plaintext into any consumer's process logs.redactSecrets()helper (src/transport/redact.js) before logging — replaces known-sensitive field names with[REDACTED]; log structure/status/*_expires_attimestamps are unchanged, and the logging toggle itself is untouched.zylos-openmax(companion fix: fix(security): redact tokens from RPC logs + harden sensitive file perms to 0600/0700 zylos-ai/zylos-openmax#100) after another team reported it leaking tokens into their PM2 logs. This SDK doesn't persist tokens to disk itself, so the log leak is the only instance of this bug here (no file-permission fix needed in this repo).package.json+src/index.jsSDK_VERSION+package-lock.jsonall updated together.Test plan
npm test— 316/316 pass, including theSDK_VERSIONdrift guard (src/version.test.js) and 7 new cases insrc/transport/redact.test.js(incl. false-positive guards for*_expires_atand fields that merely contain "token"/"secret" as a substring).test (node 20),test (node 22),semgrep,gitleaks) — pending on this PR.npm installsurfaced a pre-existing unrelatedfast-urihigh-severity advisory (transitive, via ajv) — confirmed viagit diff package-lock.jsonthat this run didn't touch that dependency, so it predates this change and is out of scope here; flagging separately rather than bundling an unrelated dependency bump into a security-log fix.Per RELEASING.md this needs an approval from someone other than the pusher (org branch ruleset) before merge, then a manual tag + release-environment approval to publish.
🤖 Generated with Claude Code