Skip to content

Comments

Security: redact query strings + WS payloads from logs#206

Open
its-DeFine wants to merge 1 commit intocloudflare:mainfrom
its-DeFine:codex/redact-secrets-in-logs-20260208
Open

Security: redact query strings + WS payloads from logs#206
its-DeFine wants to merge 1 commit intocloudflare:mainfrom
its-DeFine:codex/redact-secrets-in-logs-20260208

Conversation

@its-DeFine
Copy link

Redacts sensitive data from worker logs:

  • Never log URL query strings (often contain ?token=... / ?secret=...)
  • Stop logging WebSocket message payloads (may contain auth + user content)
  • CDP route: avoid logging request params

Motivation: prevent accidental credential leakage via logs.

PetrAnto pushed a commit to PetrAnto/moltworker that referenced this pull request Feb 24, 2026
…lock

- Bump openclaw 2026.2.3 → 2026.2.6-3 in Dockerfile (upstream PR cloudflare#204)
- Add redactWsPayload() to sanitize sensitive fields (api_key, token,
  auth, etc.) from WebSocket debug logs (upstream PR cloudflare#206)
- Add container-level lock file to prevent concurrent R2 sync operations,
  with 5-min stale lock cleanup (upstream PRs cloudflare#199, cloudflare#202)
- Add logging.test.ts for redaction utilities

https://claude.ai/code/session_01K2mQTABDGY7DnnposPdDjw
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant