Avoid logging the DC API key value

[carlosinfantes]

What

simple/util/dc_client.py logs the value of the Data Commons API key:

if _DEBUG:
  logging.info("DC API Root: %s", get_api_root())
  logging.info("DC API Key: %s", get_api_key())   # <-- logs the credential itself

This change logs whether the key is set rather than what it is, keeping the
diagnostic signal without writing the credential to the log sink.

Why it matters beyond local debugging

_DEBUG is hardcoded to True (line 38), not driven by an environment variable, so
this runs on every invocation in every deployment — not only when someone is debugging
locally.

In a Cloud Run deployment the line lands in Cloud Logging, where it is readable by
anyone with roles/logging.viewer on the project. That is a much broader audience than
the principals granted roles/secretmanager.secretAccessor on the secret the key is
mounted from, so the key effectively escapes the access model it was set up with. Log
sinks and exports widen it further.

We hit this on a Data Commons Platform deployment: the key appears in full in the
preprocessing job logs on every ingestion run.

Note on disclosure

We would have raised this privately, but this repository has no SECURITY.md and
private vulnerability reporting is not enabled, so there was no non-public channel to
use. Opening a separate issue to suggest adding one.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates simple/util/dc_client.py to prevent logging the actual DC API key when debugging is enabled, replacing it with a placeholder indicating whether the key is set or not. There are no review comments, so I have no feedback to provide.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[gmechali]

thank you for this contribution. We absolutely should be redacting these keys.