From 6daf9031a4fcd56f6027ecac1719606bc6074f6c Mon Sep 17 00:00:00 2001
From: Eliezer Traore <68350805+traoreera@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:47:17 +0000
Subject: [PATCH] Potential fix for code scanning alert no. 29: Clear-text
 logging of sensitive information

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 xcore/kernel/observability/logging.py | 33 ++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/xcore/kernel/observability/logging.py b/xcore/kernel/observability/logging.py
index d2175d67..e1192fbc 100644
--- a/xcore/kernel/observability/logging.py
+++ b/xcore/kernel/observability/logging.py
@@ -92,6 +92,22 @@ class XcoreLogger:
     """
 
     __slots__ = ("_log",)
+    _REDACTED = "***REDACTED***"
+    _SENSITIVE_KEYS = (
+        "password",
+        "passwd",
+        "pwd",
+        "secret",
+        "token",
+        "api_key",
+        "apikey",
+        "access_key",
+        "private_key",
+        "authorization",
+        "auth",
+        "cookie",
+        "session",
+    )
 
     def __init__(self, logger: logging.Logger) -> None:
         self._log = logger
@@ -100,6 +116,20 @@ def __init__(self, logger: logging.Logger) -> None:
     def name(self) -> str:
         return self._log.name
 
+    def _sanitize_fields(self, value: Any, key: str | None = None) -> Any:
+        key_l = key.lower() if isinstance(key, str) else ""
+        if any(s in key_l for s in self._SENSITIVE_KEYS):
+            return self._REDACTED
+
+        if isinstance(value, dict):
+            return {
+                str(k): self._sanitize_fields(v, key=str(k))
+                for k, v in value.items()
+            }
+        if isinstance(value, (list, tuple, set)):
+            return [self._sanitize_fields(v) for v in value]
+        return value
+
     def _emit(
         self,
         level: int,
@@ -110,7 +140,8 @@ def _emit(
     ) -> None:
         if not self._log.isEnabledFor(level):
             return
-        extra = {"xcore_ctx": fields} if fields else {}
+        safe_fields = self._sanitize_fields(fields) if fields else {}
+        extra = {"xcore_ctx": safe_fields} if safe_fields else {}
         self._log.log(level, msg, *args, exc_info=exc_info, extra=extra)
 
     def debug(self, msg: str, *args: Any, **fields: Any) -> None: