Severity: Medium
Problem
src/config/commands.ts:59–65 accepts secrets as ordinary string-valued CLI options:
--es-api-key, --es-password, --kb-api-key, --kb-password, --cloud-api-key
The flag descriptions only describe subsequent storage ("stored in the OS keychain when available"), which may give users a misleading sense that the entire handling path is protected. The value appears in process.argv before any CLI code runs and cannot be made safe retroactively by a post-parse warning.
Beyond shell history, argv is also visible in process listings, CI job logs, terminal recordings, and diagnostic bundles.
Fix
Short-term: Emit a warning for every invocation that supplies one or more of these flags. Send it to stderr; the existing appendWarnings() helper appends text to formatted output and does not guarantee stderr routing. Name the supplied flags but never include their values.
Do not recommend $(keychain:...) as an inline flag value. The expression must be quoted to avoid shell command substitution, and this code path does not pass an existing resolver expression through unchanged.
Deprecate value-taking secret flags in favor of masked TTY prompts and explicit --*-stdin/--*-env inputs; treat the warning as transitional.
Risk
Medium. Exposure is inherent to argv; no post-parse mitigation can prevent it.
Copied from the security review in elastic/infosec#27626 (ECLI-008).
Severity: Medium
Problem
src/config/commands.ts:59–65 accepts secrets as ordinary string-valued CLI options:
The flag descriptions only describe subsequent storage ("stored in the OS keychain when available"), which may give users a misleading sense that the entire handling path is protected. The value appears in
process.argvbefore any CLI code runs and cannot be made safe retroactively by a post-parse warning.Beyond shell history, argv is also visible in process listings, CI job logs, terminal recordings, and diagnostic bundles.
Fix
Short-term: Emit a warning for every invocation that supplies one or more of these flags. Send it to stderr; the existing
appendWarnings()helper appends text to formatted output and does not guarantee stderr routing. Name the supplied flags but never include their values.Do not recommend
$(keychain:...)as an inline flag value. The expression must be quoted to avoid shell command substitution, and this code path does not pass an existing resolver expression through unchanged.Deprecate value-taking secret flags in favor of masked TTY prompts and explicit
--*-stdin/--*-envinputs; treat the warning as transitional.Risk
Medium. Exposure is inherent to argv; no post-parse mitigation can prevent it.
Copied from the security review in elastic/infosec#27626 (ECLI-008).