Skip to content

Delete credentials print#2

Open
Dingisoul-DEV wants to merge 1 commit into
athapong:mainfrom
Dingisoul-DEV:main
Open

Delete credentials print#2
Dingisoul-DEV wants to merge 1 commit into
athapong:mainfrom
Dingisoul-DEV:main

Conversation

@Dingisoul-DEV

Copy link
Copy Markdown

The inspect_repository_files tool prints the GitLab API key in plaintext to stdout:

print(f"...gitlab_credentials={gitlab_credentials}")

This appears to be a debug log statement that was never removed. Any process, logging aggregator, or terminal session capturing stdout will record the API key in plaintext.

Impact

The GitLab API key is exposed to stdout on every tool invocation, and may be captured by log collection systems, CI/CD pipelines, or terminal recordings, leading to unauthorized access to the GitLab account.

Fix

Remove the debug print statement entirely. If logging is needed for diagnostics, redact the credential:

logger.debug(f"...gitlab_credentials={'***' if gitlab_credentials else 'not set'}")

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant