Add log sanitization #103

Activity

1. Michael Taufen (mtaufen)

   added

   area/securitySecurity related issue/prSecurity related issue/pr

   on May 28, 2026
2. Tim Hockin (thockin)

   added

   prio/P1Important but not criticalImportant but not critical

   on May 31, 2026
3. juli4n commented on Jun 11, 2026

   

   Julian Gutierrez Oschmann (juli4n)

   on Jun 11, 2026

   Collaborator

   More actions

   Protobuf has debug_redact = true to hint that a field can have sensitive content (e.g. key material). IIUC we are slog-ging the proto message directly, which will traverse the proto struct using reflection to convert it into a json-value.

   How about annotating all sensitive fields in our services with debug_redact and then implementing a small utility function to redact fields with this annotation? I couldn't find official protobuf/go support for this, but something like https://github.com/ntk221/redact

   Then we could instrument internal/contextlogging which defines the slog handler we use in all servers to sanitize the value if it's a protobuf Message.
4. mtaufen commented on Jun 11, 2026

   

   Michael Taufen (mtaufen)

   on Jun 11, 2026 via email

   CollaboratorAuthor

   More actions

   From what I remember, there were also some ideas in https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/1753-logs-sanitization, it was implemented in alpha but later deprecated and removed (I think due to performance concerns?): https://groups.google.com/g/kubernetes-dev/c/xhQuwdd2Smw/m/L_EyHKbDAAAJ?e=48417069, in favor of kubernetes/enhancements#1933 ( https://github.com/kubernetes/enhancements/tree/master/keps/sig-security/1933-secret-logging-static-analysis) (static analysis to prevent secret leaks).

   …

   On Wed, Jun 10, 2026 at 5:35 PM Julian Gutierrez Oschmann < ***@***.***> wrote: *juli4n* left a comment (agent-substrate/substrate#103) <#103 (comment)> Protobuf has debug_redact = true to hint that a field can have sensitive content (e.g. key material). IIUC we are slog-ging the proto message directly, which will traverse the proto struct using reflection to convert it into a json-value. How about annotating all sensitive fields in our services with debug_redact and then implementing a small utility function to redact fields with this annotation? I couldn't find official protobuf/go support for this, but something like https://github.com/ntk221/redact Then we could instrument internal/contextlogging which defines the slog handler we use in all servers to sanitize the value if it's a protobuf Message. — Reply to this email directly, view it on GitHub <#103?email_source=notifications&email_token=AAG4TQINKYP6UI4BN7OWLI347H5GPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINRXGYYDKOBVGA32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4676058507>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAG4TQMFHB2ACFFDTZ7WGYD47H5GPAVCNFSNUABGKJSXA33TNF2G64TZHMYTEMZYGA2DONJSGM5US43TOVSTWNBVGQYTONZVG43TDILWAI> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAG4TQOHXSMUQMCW3HAYQB347H5GPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINRXGYYDKOBVGA32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/AAG4TQN43OIHQNRM6XMD4HL47H5GPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINRXGYYDKOBVGA32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>
5. Da Huang (git286)

   added

   area/observability

   on Jul 28, 2026
6. Zheng Lammerts (zlammerts-svg)

   added

   prio/P2real, but not urgentreal, but not urgent

   and removed

   prio/P1Important but not criticalImportant but not critical

   on Jul 28, 2026
7. Aditya Shantanu (aditya-shantanu)

   added

   kind/featureAn enhancement / feature request or implementationAn enhancement / feature request or implementation

   on Aug 12, 2026
8. Da Huang (git286)

   self-assigned this

   on Sep 18, 2026
9. Quentin Bisson (QuentinBisson)

   added a commit that references this issue on Oct 29, 2026

   Merge pull request agent-substrate#103 from kagent-dev/sync/upstream-…

   ...

   783f8bf
10. destijl commented on Oct 29, 2026

    

    Greg Castle (destijl)

    on Oct 29, 2026

    Collaborator

    More actions

    Implemented on main:

    • Sensitive proto fields across ateapi.proto and internal RPC protos are annotated with [debug_redact = true] and scrubbed via internal/protoredact.
    • Structured logger context attributes are sanitized via internal/contextlogging (PR #1942, 3a5fc51a).
    • Validation error messages mask sensitive secret/credential inputs (PR #3071, faed88cb).
11. Greg Castle (destijl)

    closed this as completedon Oct 29, 2026