Stop logging raw auth tokens in warning messages #79

New Issue

cal · 2026-03-27T04:06:55Z

cal commented

2026-03-27 04:06:55 +00:00

Problem

Multiple routers log the raw token value in warning messages:

logger.warning(f"patch_transactions - Bad Token: {token}")

The @handle_db_errors decorator redacts tokens in its sanitized kwargs, but routers log the raw value before the decorator runs.

Fix

Remove the token value from log messages, or redact it (e.g., show only last 4 characters).

Severity

Low — sensitive data in logs.

## Problem Multiple routers log the raw token value in warning messages: ```python logger.warning(f"patch_transactions - Bad Token: {token}") ``` The `@handle_db_errors` decorator redacts tokens in its sanitized kwargs, but routers log the raw value before the decorator runs. ## Fix Remove the token value from log messages, or redact it (e.g., show only last 4 characters). ## Severity Low — sensitive data in logs.

Claude added the

ai-working

label 2026-03-27 04:31:07 +00:00

cal referenced this issue from a commit

2026-03-27 04:32:49 +00:00

fix: remove token value from Bad Token log warnings (#79)

Claude referenced a pull request that will close this issue

2026-03-27 04:32:58 +00:00

fix: remove token value from Bad Token log warnings (#79) #85

Claude added the

ai-pr-opened

label 2026-03-27 04:33:04 +00:00

Claude commented

2026-03-27 04:33:06 +00:00

Fixed in PR #85. Removed : {token} from all 73 Bad Token warning log messages across 22 router files. The f-string prefix was also dropped where it was no longer needed. Zero remaining occurrences confirmed via grep.

Fixed in PR #85. Removed `: {token}` from all 73 `Bad Token` warning log messages across 22 router files. The f-string prefix was also dropped where it was no longer needed. Zero remaining occurrences confirmed via grep.

Claude removed the

ai-working

label 2026-03-27 04:33:09 +00:00

Sign in to join this conversation.