harden: runtime debug mode logs full request URLs and bodies, which can include RPC credentials #410

New Issue

2026-09-21T20:37:57+02:00

clawbot commented

2026-09-21 20:37:57 +02:00

Severity: privacy.

Where. src/shared/log.js:45-53 (debugFetch logs the method, URL and body
at debug level); src/popup/views/settings.js:410-416 (the settings toggle
raises the runtime log level).

What is wrong. With debug mode on, every RPC and explorer request is logged
to the console with its full URL and request body. A user who has configured an
RPC endpoint with a key or token embedded in the URL writes that secret to the
browser console, where it persists in logs. The README says debug mode raises
the log level (true), but does not state this consequence.

Why it matters. A configured RPC URL bearing a credential is exposed in the
console log whenever debug mode is on.

Reproduction. Configure an RPC URL containing a token; enable debug mode;
open the extension console — the URL with the token is printed on every request.

Acceptable. Log the request origin and path without the query string (and
without any credential-bearing path segment) in debugFetch, or state the
consequence next to the debug toggle.

Definition of done.

debugFetch does not log URL query strings (or otherwise redacts
credentials) by default.
If any URL detail is still logged, the debug toggle's help text states it.
A test asserts a tokened URL is not logged verbatim.

Model: fable-5-1 (review); opus-4-8 (filing)

Severity: privacy. **Where.** `src/shared/log.js:45-53` (`debugFetch` logs the method, URL and body at debug level); `src/popup/views/settings.js:410-416` (the settings toggle raises the runtime log level). **What is wrong.** With debug mode on, every RPC and explorer request is logged to the console with its full URL and request body. A user who has configured an RPC endpoint with a key or token embedded in the URL writes that secret to the browser console, where it persists in logs. The README says debug mode raises the log level (true), but does not state this consequence. **Why it matters.** A configured RPC URL bearing a credential is exposed in the console log whenever debug mode is on. **Reproduction.** Configure an RPC URL containing a token; enable debug mode; open the extension console — the URL with the token is printed on every request. **Acceptable.** Log the request origin and path without the query string (and without any credential-bearing path segment) in `debugFetch`, or state the consequence next to the debug toggle. **Definition of done.** - [ ] `debugFetch` does not log URL query strings (or otherwise redacts credentials) by default. - [ ] If any URL detail is still logged, the debug toggle's help text states it. - [ ] A test asserts a tokened URL is not logged verbatim. Model: fable-5-1 (review); opus-4-8 (filing)

clawbot referenced this issue

2026-09-21 20:39:01 +02:00

security: pre-1.0 review of key handling, DEBUG mode and RPC/dApp input validation #383

~~clawbot referenced this issue 2026-10-03 14:21:22 +02:00~~

Review toward 1.0: identify and file all next steps #382

clawbot commented

2026-10-04 19:43:51 +02:00

Plan. One PR on a branch cut from next, base next.

debugFetch in src/shared/log.js logs only the HTTP method, the URL's origin (scheme://host[:port]) and, for a JSON-RPC body, its method name. No path (RPC providers commonly put the key there), no query string, no full body.
With nothing credential-bearing logged, the debug toggle's help text needs no warning; it stays as it is unless it claims full URLs are logged.
Test: a fetch to an RPC URL with a key in the path and a token in the query logs neither, and still logs the origin and the JSON-RPC method; it fails against current next.

Model: opus-5-5

Plan. One PR on a branch cut from `next`, base `next`. - `debugFetch` in `src/shared/log.js` logs only the HTTP method, the URL's origin (`scheme://host[:port]`) and, for a JSON-RPC body, its `method` name. No path (RPC providers commonly put the key there), no query string, no full body. - With nothing credential-bearing logged, the debug toggle's help text needs no warning; it stays as it is unless it claims full URLs are logged. - Test: a fetch to an RPC URL with a key in the path and a token in the query logs neither, and still logs the origin and the JSON-RPC method; it fails against current `next`. Model: opus-5-5

clawbot referenced this issue from a commit

2026-10-04 19:50:52 +02:00

harden: debug mode logs only a request's origin and JSON-RPC method (closes #410)

clawbot referenced this issue

2026-10-04 19:52:04 +02:00

harden: debug mode logs only a request's origin and JSON-RPC method #436

clawbot commented

2026-10-04 19:52:12 +02:00

Built in #436. Debug mode now logs a request's HTTP method, its URL's origin and, for a JSON-RPC call, the method name; never the URL's path or query string or the body. The balance refresh and token lookup log the RPC endpoint by its origin too. The README's DEBUG Mode Policy says what debug mode logs.

Model: opus-5-5

Built in https://git.eeqj.de/sneak/AutistMask/pulls/436. Debug mode now logs a request's HTTP method, its URL's origin and, for a JSON-RPC call, the method name; never the URL's path or query string or the body. The balance refresh and token lookup log the RPC endpoint by its origin too. The README's DEBUG Mode Policy says what debug mode logs. Model: opus-5-5

clawbot referenced this issue from a commit

2026-10-04 20:16:03 +02:00

harden: debug mode logs only a request's origin and JSON-RPC method (closes #410)

clawbot referenced this issue from a commit

2026-10-04 20:49:44 +02:00

harden: debug mode logs only a request's origin and JSON-RPC method (closes #410)

clawbot referenced this issue from a commit

2026-10-04 21:09:05 +02:00

harden: debug mode logs only a request's origin and JSON-RPC method (closes #410)

clawbot closed this issue

2026-10-04 21:09:12 +02:00

clawbot referenced this issue