Security: raw config-to-env output (decrypted secrets) is echoed to pod logs on failure
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 77/100
Research direction
Open scripts/docker-entrypoint.sh at line 187 and inspect how the failure message uses $config_env_output and $config_err_output. Remove stdout from the logged message while keeping the failure reason, exit code, and redacted stderr. Confirm the failure log no longer includes config-to-env output.
Written by the indexing model from the issue text.
Description
Finding (medium): config-to-env output echoed to the log on failure
scripts/docker-entrypoint.sh:187 (commit fe16600): echo "[CONFIG] ERROR: Failed to load config from '$CONFIG_SVC' ($config_fail_reason, exit code $config_exit): $config_env_output $config_err_output" >&2.
$config_env_output is the stdout of npx @osaas/cli web config-to-env: export NAME=value lines that include secret parameters decrypted with CONFIG_API_KEY. When the load is marked failed (non-zero exit, timeout, or output with no valid export line) the stdout, which may hold partial exports, goes to stderr, the pod log, Loki and anyone with log access.
Suggested fix: print only $config_fail_reason, the exit code and a redacted $config_err_output; never print the stdout.
Siblings with the same line: Eyevinn/web-runner#75, Eyevinn/python-runner#38, wasm-runner (filed separately).
Lessons
Found by the #269 logger-call sweep (Eyevinn/osaas-maker-manager#275, ticket S4); static read of a tarball of the default branch, not reproduced live. Source: Eyevinn/osaas-maker-manager#269.
🤖 Generated with Claude Code
Co-Authored-By: Claude Sonnet 5.5 [email protected]
- Dominant language
- Shell
- Stars
- 0
- Forks
- 2
- Avg merge
- 45m
- Merged PRs (30d)
- 6
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Similar issues
-
enhancement good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
elhajahmadj/offline-emergency-library#157 ·
Maintainers usually reply within 1 day
-
idea-scout idea:245
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
jeanibarz/agent-notebook#245 ·
Maintainers usually reply within 1 day
-
7.2 user documentation (HelpHub)
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
WordPress/Documentation-Issue-Tracker#2559 · 1 comment ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 61/100
JWhite212/SignalLadder#215 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 1 day