init-db logs the full Postgres connection URL including the password
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 88/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- javascript, postgres
Research direction
Start in bin/init-db.js at the “ensuring database exists” log site and inspect how the resolved PostgreSQL URL is assembled for logging. Verify the resulting startup log retains useful host or database information without exposing credentials, and check the mentioned worker/server startup paths for consistency.
Written by the indexing model from the issue text.
Description
What happens
bin/init-db.js logs the resolved connection string verbatim at startup:
{"level":30,...,"module":"init-db","database":"keryx","postgresUrl":"postgres://user:<url-encoded-password>@host:5432/db?ssl=true","msg":"ensuring database exists"}
Deployments that run init-db as an initContainer (as recommended for the 0.7.0 DDL) ship this line — password included — to whatever log pipeline scrapes pod stdout (Loki/CloudWatch/Datadog/...). We hit this today on our staging rollout of 0.7.0: the database password is now sitting in our log store and has to be rotated.
Expected
Redact credentials before logging, e.g. log url.host + url.pathname only, or replace the password component with ***:
const safe = new URL(postgresUrl); safe.password = safe.password ? '***' : '';
log.info({ postgresUrl: safe.toString(), database }, 'ensuring database exists')
Same consideration applies anywhere else a connection URL is logged (worker/server startup paths log host-only today, which is good — init-db is the outlier).
Version
@y/hub 0.7.0 (bin/init-db.js, the ensuring database exists log site).
- Dominant language
- JavaScript
- Stars
- 301
- Forks
- 58
- Avg merge
- 28m
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from yjs/yhub
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
-
Document-level worker quarantine (pause compaction for a room) in addition to stream quarantine Open
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·