Skip to content

Conversation

@jhamon
Copy link
Collaborator

@jhamon jhamon commented Feb 3, 2026

Summary

Fixed security vulnerability where API key response objects containing sensitive data were being logged in clear text in test files.

Changes

  • Modified tests/integration/rest_sync/admin/test_api_key.py to log only non-sensitive API key IDs instead of full response objects
  • This prevents exposure of sensitive data (passwords/API key values) in logs

Security Impact

Testing

  • Existing tests continue to pass
  • Pre-commit hooks passed

Made with Cursor


Note

Low Risk
Low risk test-only change that reduces exposure of sensitive API key material in logs; no runtime behavior is affected.

Overview
Updates the admin API key integration test to stop logging full API key response objects and instead log only non-sensitive identifiers (the key id) when fetching via fetch/get aliases, preventing accidental leakage of API key values in test logs.

Written by Cursor Bugbot for commit a5cf44f. This will update automatically on new commits. Configure here.

Fixed security vulnerability (CWE-312, CWE-532) where API key response
objects containing sensitive data were being logged. Now only logging
non-sensitive IDs instead of full response objects.

Resolves code scanning alert #72

Co-authored-by: Cursor <cursoragent@cursor.com>
@jhamon jhamon changed the title fix: prevent logging sensitive API key data in clear text fix: prevent logging sensitive API key data in test Feb 3, 2026
@jhamon jhamon merged commit c6d7044 into main Feb 3, 2026
42 of 43 checks passed
@jhamon jhamon deleted the fix/security-alert-72-clear-text-logging branch February 3, 2026 08:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant