From a3ec69d2be361e30b4bb694f7d4ea5bac1464376 Mon Sep 17 00:00:00 2001 From: chemavx Date: Fri, 26 Jun 2026 15:13:32 +0000 Subject: [PATCH] fix(security): stop httpx from logging GNEWS_API_KEY in plaintext httpx logs every request URL at INFO level, and the GNews search URL carries the API key as a `?token=` query param, so GNEWS_API_KEY was written in plaintext into the pod logs on every news query. Raise the httpx/httpcore loggers to WARNING so request URLs never reach INFO. The bot's own GNews log lines only print the sanitised keyword query (NewsClient._build_query), never the token, so they are unaffected. Co-Authored-By: Claude Opus 4.8 --- bot/main.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/bot/main.py b/bot/main.py index 31558e1..02dbc90 100644 --- a/bot/main.py +++ b/bot/main.py @@ -27,6 +27,12 @@ logging.basicConfig( level=logging.INFO, format="%(asctime)s [%(levelname)s] %(name)s: %(message)s", ) +# httpx logs every request URL at INFO, and the GNews URL carries the API key as +# a `?token=` query param — that would leak GNEWS_API_KEY in plaintext into the +# pod logs. Raise httpx/httpcore to WARNING so request URLs never reach INFO. +# The bot's own GNews log lines only print the sanitised query, not the token. +logging.getLogger("httpx").setLevel(logging.WARNING) +logging.getLogger("httpcore").setLevel(logging.WARNING) log = logging.getLogger("bot.main") PAPER_MODE = os.getenv("PAPER_MODE", "true").lower() == "true"