fix(lit-actions): redact js_params/headers/auth_context from logs by default (CPL-369) - #616
Open
GTC6244 wants to merge 5 commits into
Conversation
…default (CPL-369) User js_params, request headers, and auth_context were logged at debug and exported to GCP Cloud Logging unless a client set a forgeable privacy header — customer secrets left the TEE by default. Invert the default: redact these fields in all request-logging sites, gated by a new operator-only `LIT_LOG_SENSITIVE_DATA` opt-out (read once from the process env, never client-controllable). DebugExecutionRequest self-redacts, so the gRPC servers no longer depend on the forgeable request-id privacy suffix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses CPL-369 by preventing user-supplied sensitive request data from being logged by default in the lit-actions execution path, adding an operator-only env opt-in to re-enable sensitive logging for local debugging, and centralizing redaction in the Debug rendering used at request-log sites.
Changes:
- Added
lit_observability::sensitive_logging_enabled()gated byLIT_LOG_SENSITIVE_DATA, cached once per process. - Updated JS runner and gVisor gRPC servers to log
DebugExecutionRequestunconditionally (with default redaction) and removed request-id-suffix privacy checks. - Implemented self-redacting
DebugExecutionRequestand added a unit test asserting default redaction ofjs_params,auth_context, andhttp_headers.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| lit-core/lit-observability/src/lib.rs | Adds operator-only env-gated sensitive logging toggle (cached). |
| lit-actions/server/server.rs | Switches request logging to rely on DebugExecutionRequest redaction and removes request-id privacy suffix logic. |
| lit-actions/server/runtime.rs | Redacts js_params and headers logging by default, gated by sensitive_logging_enabled(). |
| lit-actions/gvisor-server/src/server.rs | Switches request logging to rely on DebugExecutionRequest redaction and removes request-id privacy suffix logic. |
| lit-actions/grpc/proto.rs | Makes DebugExecutionRequest self-redacting by default and adds a unit test for redaction. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…ic test (CPL-369) Address PR review: restore the explicit privacy-mode branch at both gRPC log sites so an X-Privacy-Mode request still suppresses non-secret request metadata (truncated code, ids) — these run before request context is set, so PrivacyModeLayer cannot filter them. Default redaction of secrets is unchanged. Also make the redaction unit test deterministic by clearing the opt-in env var before the cached first read, and correct opt-out -> opt-in wording. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…gged-at-debug-exported-to-gcp-in
…gged-at-debug-exported-to-gcp-in
…nned) smartstring's repo was archived 2026-05-03; the advisory was newly published and started failing cargo-deny. smartstring 1.0.1 is a transitive of swc_ecma_lexer <- deno_ast =0.53.2 (lit-actions only), so it is deno-pinned and not removable in-house. Matches the existing deno-blocked ignore entries. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes CPL-369 (High). User
js_params, request headers, andauth_contextwere logged at debug and exported to GCP Cloud Logging unless a client opted into a forgeable privacy header — so customer secrets left the TEE by default. This inverts the default: all request-logging sites now redact these fields, gated by a new operator-onlyLIT_LOG_SENSITIVE_DATAenv opt-out that is read once from the process environment and is never client-controllable.DebugExecutionRequestself-redacts, so both gRPC servers (JS runner and gVisor) no longer depend on the forgeable request-id privacy suffix, and the redundant client-header privacy checks were removed.code(truncated), timeouts, and IDs stay visible for debugging; a new unit test asserts secrets never appear in the default log rendering. The existingX-Privacy-Modefull-log-suppression path is left untouched as an optional stronger guarantee.🤖 Generated with Claude Code