https://docs.all-hands.dev/ logo
Join Slack
Powered by
Separately, we're leaking API keys in this log ```...
# proj-automation
w
Separately, we're leaking API keys in this log
Copy code
Command timed out after 300 seconds: mkdir -p /root/.openhands/agent-canvas/workspaces/automation-runs/27fa5d48-a741-416d-a5c3-109d1d336a51 && tar xzf /tmp/automation-27fa5d48-a741-416d-a5c3-109d1d336a51.tar.gz -C /root/.openhands/agent-canvas/workspaces/automation-runs/27fa5d48-a741-416d-a5c3-109d1d336a51 && rm -f /tmp/automation-27fa5d48-a741-416d-a5c3-109d1d336a51.tar.gz && cd /root/.openhands/agent-canvas/workspaces/automation-runs/27fa5d48-a741-416d-a5c3-109d1d336a51 && export AGENT_SERVER_URL='<http://localhost:18000>' && export SESSION_API_KEY=....
@nutritious-balloon-65098 create an issue in openhands/agent-canvas
n
I'm on it! Robert Brennan can track my progress here.
Summary Task: Create a GitHub issue in 
openhands/agent-canvas
about API keys being leaked in automation run logs. Result: ✅ Issue created successfully — #1470: Security: SESSION_API_KEY leaked in automation run command logs What the issue covers: • Observed behavior: When an automation run times out, the full shell command is logged verbatim, including 
export SESSION_API_KEY=<plaintext value>
• Impact: Anyone with log access (monitoring dashboards, CI artifacts, log aggregators) can read a valid session API key, which grants full agent-server API access • Three suggested fixes: a. Mask known-sensitive variable names before writing commands to logs b. Pass secrets via subprocess 
env
parameter rather than embedding them in the command string c. Scrub all log sites (startup, retry, timeout, failure handlers) for credential-bearing content • Labels: 
security
, 
bug
• AI disclosure: Noted in the issue body that it was created by an AI agent on behalf of the user No code changes were made — this was purely an issue creation task.
2 Views
Open in Slack
PreviousNext
Powered by