From 525fdf3aca3c81f770f9c740cf41bf23df5abee5 Mon Sep 17 00:00:00 2001 From: Carlos Infantes Date: Wed, 5 Aug 2026 17:57:36 +0200 Subject: [PATCH] Avoid logging the DC API key value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The debug block logs the key itself, so the credential ends up in plain text in whatever log sink the deployment uses. On Cloud Run that means Cloud Logging, where it is readable by anyone holding roles/logging.viewer on the project — a considerably wider audience than those granted access to the secret. _DEBUG is hardcoded to True, so this happens on every run of the preprocessing job in any deployment, not just when debugging locally. Log whether the key is set instead of its value, which keeps the diagnostic signal (is it configured?) without disclosing the credential. --- simple/util/dc_client.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/simple/util/dc_client.py b/simple/util/dc_client.py index 58ccf478d..3220c67f6 100644 --- a/simple/util/dc_client.py +++ b/simple/util/dc_client.py @@ -73,7 +73,7 @@ def get_api_root(): if _DEBUG: logging.info("DC API Root: %s", get_api_root()) - logging.info("DC API Key: %s", get_api_key()) + logging.info("DC API Key: %s", "" if get_api_key() else "") os.makedirs(_DEBUG_FOLDER, exist_ok=True)