From 0bd92269d20540f57634c0726664188c1178e485 Mon Sep 17 00:00:00 2001 From: Logan Cusano Date: Sun, 16 Aug 2026 20:05:29 -0400 Subject: [PATCH] Stop httpx logging API keys in plaintext httpx logs every request at INFO as a full URL including the query string, so the Google Maps key appeared in c2-core's container logs on every geocode call -- `?address=Holland+Station&...&key=AIza...`. Anyone who can read the logs, or who is pasted a few lines of them, has the key. It was found exactly that way while checking why the map was empty. Nothing in this service needs per-request client logging; callers already log their own failures with context. httpx and httpcore drop to WARNING, so real transport errors still surface and the URLs stop being printed. This does not un-leak the existing key -- it is in the container's log history and has to be rotated in GCP separately. Co-Authored-By: Claude Opus 5 --- drb-c2-core/app/internal/logger.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drb-c2-core/app/internal/logger.py b/drb-c2-core/app/internal/logger.py index 13ead5c..76c9d37 100644 --- a/drb-c2-core/app/internal/logger.py +++ b/drb-c2-core/app/internal/logger.py @@ -7,4 +7,12 @@ logging.basicConfig( handlers=[logging.StreamHandler(sys.stdout)], ) +# httpx logs every request at INFO as a full URL *including the query string*, +# which puts API keys in plaintext in container logs — the Google Maps key was +# leaking on every geocode call (`?address=...&key=AIza...`). Nothing here needs +# per-request client logging, so drop httpx to WARNING; failures still surface +# because the callers log their own errors. +logging.getLogger("httpx").setLevel(logging.WARNING) +logging.getLogger("httpcore").setLevel(logging.WARNING) + logger = logging.getLogger("drb-c2-core")