sensitive-logging-audit

1---2name: sensitive-logging-audit3description: Audit or fix sensitive-data exposure in Python SDK diagnostics, exceptions, logging, and telemetry.4---5 6# Sensitive Logging Audit7 8## Objective9 10Find candidate output sinks, trace their values manually, fix demonstrated leaks at shared runtime boundaries, and prove redaction with adversarial tests.11 12The collector is only a syntax-based search aid. It does not resolve Python aliases or control flow, certify policy guards, or prove that an absent candidate is safe.13 14## Workflow15 16### 1. Establish the review surface17 18- Work in the current checkout and preserve unrelated changes.19- Read `src/agents/_debug.py`, `src/agents/logger.py`, and the affected callers.20- Treat exception messages, arguments, tracebacks, causes, contexts, notes, names, URLs, and arbitrary values as potentially sensitive.21- Read [the Python redaction validation matrix](references/redaction-validation.md).22 23Run the collector tests, then collect candidates:24 25```bash26uv run python .agents/skills/sensitive-logging-audit/scripts/test_inventory.py27uv run python .agents/skills/sensitive-logging-audit/scripts/inventory_logging.py \28  --format json --output /tmp/sensitive-logging-candidates.json29```30 31The report intentionally contains no `policy`, `safe`, or guard classification.32 33### 2. Supplement the collector with source search34 35The collector does not follow assignments such as `emit = logger.error`. Search the source directly and inspect aliases, callbacks, wrappers, and reflective dispatch:36 37```bash38rg -n '\.(debug|info|warning|warn|error|exception|critical|fatal|log)\b' src/agents39rg -n '\b(print|pprint|pp|warn|warn_explicit|write|writelines|print_exc|print_exception)\b' src/agents40rg -n 'DONT_LOG_(MODEL|TOOL)_DATA|log_(model|tool|model_and_tool)_action' src/agents41```42 43Do not turn collector coverage or a textual guard into a security conclusion. Trace producers and callers.44 45### 3. Classify manually46 47Assign each reviewed path one disposition:48 49- `model`: model requests, responses, Realtime events, or derived values.50- `tool`: tool arguments, outputs, MCP data, tool events, or derived values.51- `model+tool`: either class may reach the sink.52- `operational`: demonstrated to contain only non-sensitive SDK metadata.53- `intentional-output`: explicitly user-facing output rather than diagnostics.54- `uncertain`: source tracing is incomplete.55 56Record evidence in the audit report. The script does not validate or inherit dispositions.57 58### 4. Fix runtime boundaries59 60Before changing runtime behavior, use `$implementation-strategy`.61 62- Check the relevant `_debug.DONT_LOG_MODEL_DATA` and `_debug.DONT_LOG_TOOL_DATA` flags before formatting or inspecting sensitive values.63- Redact mixed model/tool values when either flag disables data logging.64- In redacted mode, emit a fixed message and omit sensitive `args`, `extra`, and `exc_info`.65- Build diagnostic-only context lazily so redacted mode never reads it.66- Preserve useful diagnostics when sensitive-data logging is explicitly enabled.67- Keep logging failure from changing fallback, cleanup, event, rejection, or cancellation behavior.68- For MCP URLs, remove credentials, query parameters, and fragments in diagnostic mode; never use sanitized names as a substitute for fixed redacted messages.69 70### 5. Prove caller behavior71 72Add tests at every changed caller boundary. Inspect the complete `LogRecord`, not only rendered text. Test both redacted policies, diagnostic mode, hostile objects, exception chains, and the caller's observable fallback or cleanup behavior as applicable.73 74### 6. Re-run and close out75 76Re-run the collector, the manual searches, focused tests, and applicable repository gates. Use `$code-change-verification` for runtime or test changes and `$pr-draft-summary` when required.77 78Report candidate counts as search coverage only. Lead with confirmed leaks fixed, retained intentional output, reviewed uncertainty, and verification results. Never report a clean collector result as proof that no sensitive logging path exists.79