{"action":"created","issue":{"url":"https://api.github.com/repos/drone/drone/issues/1584","repository_url":"https://api.github.com/repos/drone/drone","labels_url":"https://api.github.com/repos/drone/drone/issues/1584/labels{/name}","comments_url":"https://api.github.com/repos/drone/drone/issues/1584/comments","events_url":"https://api.github.com/repos/drone/drone/issues/1584/events","html_url":"https://github.com/drone/drone/issues/1584","id":149660623,"number":1584,"title":"Sanitize log output for secrets","user":{"login":"wrouesnel","id":772445,"avatar_url":"https://avatars.githubusercontent.com/u/772445?v=3","gravatar_id":"","url":"https://api.github.com/users/wrouesnel","html_url":"https://github.com/wrouesnel","followers_url":"https://api.github.com/users/wrouesnel/followers","following_url":"https://api.github.com/users/wrouesnel/following{/other_user}","gists_url":"https://api.github.com/users/wrouesnel/gists{/gist_id}","starred_url":"https://api.github.com/users/wrouesnel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wrouesnel/subscriptions","organizations_url":"https://api.github.com/users/wrouesnel/orgs","repos_url":"https://api.github.com/users/wrouesnel/repos","events_url":"https://api.github.com/users/wrouesnel/events{/privacy}","received_events_url":"https://api.github.com/users/wrouesnel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-04-20T05:13:00Z","updated_at":"2016-04-20T06:13:18Z","closed_at":null,"body":"Drone should implement some basic log parsing for the web UI so secret exposure can be fail-safed.\r\n\r\nThis would be implemented by treating specified secrets as an array of \"do not print\" words, and scrubbing them from the log output.\r\n\r\nWhile there is an obvious vector here of weak-passwords being highlighted by emitted text, this is marginal compared to the benefits of \"failing safe\" for the common case, and could be mitigated by assigning secrets as \"fail if appears in logs\" by default (which you should never really need to turn off).\r\n"},"comment":{"url":"https://api.github.com/repos/drone/drone/issues/comments/212276610","html_url":"https://github.com/drone/drone/issues/1584#issuecomment-212276610","issue_url":"https://api.github.com/repos/drone/drone/issues/1584","id":212276610,"user":{"login":"bradrydzewski","id":817538,"avatar_url":"https://avatars.githubusercontent.com/u/817538?v=3","gravatar_id":"","url":"https://api.github.com/users/bradrydzewski","html_url":"https://github.com/bradrydzewski","followers_url":"https://api.github.com/users/bradrydzewski/followers","following_url":"https://api.github.com/users/bradrydzewski/following{/other_user}","gists_url":"https://api.github.com/users/bradrydzewski/gists{/gist_id}","starred_url":"https://api.github.com/users/bradrydzewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradrydzewski/subscriptions","organizations_url":"https://api.github.com/users/bradrydzewski/orgs","repos_url":"https://api.github.com/users/bradrydzewski/repos","events_url":"https://api.github.com/users/bradrydzewski/events{/privacy}","received_events_url":"https://api.github.com/users/bradrydzewski/received_events","type":"User","site_admin":false},"created_at":"2016-04-20T06:13:18Z","updated_at":"2016-04-20T06:13:18Z","body":"@nlf wondering if you had any thoughts from a security perspective. How can we help prevent someone from exposing secrets in the logs without creating a potential vector for exposing passwords? (see my prior comment)"}}