Finding
get_inner() (line 98) and the download() trait methods (torznab.rs:196, newznab.rs:187, cardigann/mod.rs:602) are #[instrument]-annotated without skipping url, so tracing auto-captures the raw indexer URL — which embeds the apikey= query param — as a span field; any debug/warn event during the span (trivially reached via RUST_LOG=debug troubleshooting) prints the unredacted key, bypassing the redact_api_key() discipline the same files apply to every error.
Evidence
crates/zetesis/src/cf_bypass/byparr.rs:98 (also torznab.rs:196, newznab.rs:187, cardigann/mod.rs:602). Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).
Why this matters
Enabling debug/warn logging — a routine troubleshooting step — prints the full indexer URL including its apikey query parameter in plaintext, undermining the redaction discipline the rest of the code enforces.
Desired correction
Add url to each #[instrument(skip(...))] list, or replace it with an explicit redacted field: fields(url = %crate::client::redact_api_key(url)).
Done when: the defect's failure mode no longer reproduces and a regression test covers it.
Finding
get_inner() (line 98) and the download() trait methods (torznab.rs:196, newznab.rs:187, cardigann/mod.rs:602) are #[instrument]-annotated without skipping
url, so tracing auto-captures the raw indexer URL — which embeds the apikey= query param — as a span field; any debug/warn event during the span (trivially reached via RUST_LOG=debug troubleshooting) prints the unredacted key, bypassing the redact_api_key() discipline the same files apply to every error.Evidence
crates/zetesis/src/cf_bypass/byparr.rs:98 (also torznab.rs:196, newznab.rs:187, cardigann/mod.rs:602). Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).Why this matters
Enabling debug/warn logging — a routine troubleshooting step — prints the full indexer URL including its apikey query parameter in plaintext, undermining the redaction discipline the rest of the code enforces.
Desired correction
Add
urlto each #[instrument(skip(...))] list, or replace it with an explicit redacted field: fields(url = %crate::client::redact_api_key(url)).Done when: the defect's failure mode no longer reproduces and a regression test covers it.