Skip to content

secrets: tracing spans capture unredacted indexer API keys #521

Description

@forkwright

Finding

get_inner() (line 98) and the download() trait methods (torznab.rs:196, newznab.rs:187, cardigann/mod.rs:602) are #[instrument]-annotated without skipping url, so tracing auto-captures the raw indexer URL — which embeds the apikey= query param — as a span field; any debug/warn event during the span (trivially reached via RUST_LOG=debug troubleshooting) prints the unredacted key, bypassing the redact_api_key() discipline the same files apply to every error.

Evidence

crates/zetesis/src/cf_bypass/byparr.rs:98 (also torznab.rs:196, newznab.rs:187, cardigann/mod.rs:602). Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).

Why this matters

Enabling debug/warn logging — a routine troubleshooting step — prints the full indexer URL including its apikey query parameter in plaintext, undermining the redaction discipline the rest of the code enforces.

Desired correction

Add url to each #[instrument(skip(...))] list, or replace it with an explicit redacted field: fields(url = %crate::client::redact_api_key(url)).

Done when: the defect's failure mode no longer reproduces and a regression test covers it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions