Skip to content

Conversation

devin-ai-integration[bot]
Copy link
Contributor

Summary

Apply private key masking to deployment script logging across 3 additional contract manager scripts. This extends the fix from PR #3078 to prevent private keys from being logged in plaintext during contract deployments.

Rationale

PR #3078 fixed private key logging in deploy_evm_executor_contracts.ts, but a comprehensive audit revealed 3 additional deployment scripts that log the entire deploymentConfig object containing private keys:

  • deploy_evm_entropy_contracts.ts
  • deploy_evm_pricefeed_contracts.ts
  • deploy_evm_pulse_contracts.ts

These scripts could expose private keys in deployment logs, creating a security risk.

Changes

Each script now follows the identical pattern from PR #3078:

  1. Creates a maskedDeploymentConfig object that spreads the original config
  2. Overrides the privateKey field with <REDACTED> (or undefined if no key exists)
  3. Logs the masked config instead of the original

How has this been tested?

  • Current tests cover my changes (no deployment logic modified)
  • Added new tests (logging behavior not covered by automated tests)
  • Manually tested the code (pre-commit hooks passed, no syntax errors)

The changes are purely cosmetic (logging only) and don't modify any deployment functionality. Pre-commit hooks including linting and formatting passed successfully.

Review Checklist

Critical items for review:

Security consideration: This addresses the immediate issue of private key exposure in deployment logs, but reviewers may want to consider if there are other potential vectors for private key leakage not covered by this change.


Link to Devin run: https://app.devin.ai/sessions/b55e7883b27b47f6958a04f1886ff362
Requested by: aditya@dourolabs.xyz

Co-Authored-By: aditya@dourolabs.xyz <aditya@dourolabs.xyz>
Copy link
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

Copy link

vercel bot commented Oct 3, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
api-reference Ready Ready Preview Comment Oct 3, 2025 11:16am
component-library Ready Ready Preview Comment Oct 3, 2025 11:16am
developer-hub Ready Ready Preview Comment Oct 3, 2025 11:16am
4 Skipped Deployments
Project Deployment Preview Comments Updated (UTC)
entropy-explorer Skipped Skipped Oct 3, 2025 11:16am
insights Skipped Skipped Oct 3, 2025 11:16am
proposals Skipped Skipped Oct 3, 2025 11:16am
staking Skipped Skipped Oct 3, 2025 11:16am

Copy link
Contributor

@bplatak bplatak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

10/10 work there Devin 🙇

@aditya520 aditya520 merged commit 5cf8c37 into main Oct 3, 2025
10 checks passed
@aditya520 aditya520 deleted the devin/1759489764-mask-private-keys branch October 3, 2025 11:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants