fix: don't show full api key in logs #5162
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Greptile Summary
This PR addresses a critical security vulnerability where API keys were being exposed in debug logs. The fix modifies the log_model_configs method in the DefaultMultiLLM class to use a masked version of the configuration instead of logging the raw config.
The change introduces a _safe_model_config method that creates a sanitized copy of the configuration where the API key is masked using the existing mask_string utility function (which shows only the last 4 characters). The log_model_configs method now calls this safe version instead of directly logging self.config.
This fix is essential for maintaining security best practices in production environments where log files could be accessed by multiple parties. The implementation preserves the debugging functionality while preventing sensitive credentials from appearing in application logs. The code reorganization moves _safe_model_config above log_model_configs to satisfy the dependency relationship between these methods.
Confidence score: 5/5
- This PR is extremely safe to merge with no risk of production issues
- Score reflects a straightforward security fix with clear implementation and no complex logic changes
- No files require special attention as this is a focused security improvement
1 file reviewed, no comments
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
cubic analysis
No issues found across 1 file. Review in cubic
Description
title
How Has This Been Tested?
locally
Backporting (check the box to trigger backport action)
Note: You have to check that the action passes, otherwise resolve the conflicts manually and tag the patches.
Summary by cubic
API keys are now masked in logs to prevent exposing full keys during model configuration logging.