T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:554
- Finding
- Unredacted API Request Logging May Expose Credentials and Donor Data## Vulnerability Details **File Location**: `SKILL.md:554` **Supporting Locations**: `SKILL.md:568-595`, `SKILL.md:611-638`, `SKILL.md:651-681` **Vulnerability Type**: Sensitive information exposure through unsafe logging guidance **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### Best Practices 1. Implement exponential backoff for rate limits 2. Log all API errors with request details 3. Validate data before sending to API 4. Handle null values gracefully 5. Check for finalized fees using Events endpoint ``` The request details covered by this instruction may contain sensitive headers and payload fields: ```python headers = { 'Authorization': f'Bearer {API_KEY}', 'Accept': 'application/json', 'Content-Type': 'application/json' } def create_donation(campaign_id, amount, currency, payment_method_id, supporter): url = f'{BASE_URL}/donations' data = { 'campaign_id': campaign_id, 'amount': str(amount), 'currency': currency, 'payment_method_id': payment_method_id, 'supporter': supporter } response = requests.post(url, headers=headers, json=data) response.raise_for_status() return response.json() ``` ### Technical Analysis The skill instructs implementers to log all API errors “with request details” without defining a redaction policy. FundraiseUp requests include a bearer API credential in the `Authorization` header. Donation request bodies can also include Stripe payment-method identifiers and supporter names, email addresses, telephone numbers, and mailing addresses. Error handlers frequently serialize HTTP request headers, bodies, exception objects, or client-library request configurations. Following this guidance literally could therefore write reusable credentials and donor personally identifiable information to application logs. Logs commonly have broader readership and longer retention tha ...[truncated 2091 chars]
- Remediation
- ## Remediation Suggestions Replace the broad logging instruction with an explicit structured-logging and redaction policy: 1. Never log `Authorization`, cookies, API keys, donor-portal access URLs or tokens, Stripe payment-method identifiers, or complete request and response bodies. 2. Log only allowlisted diagnostic fields, such as the HTTP status code, sanitized endpoint template, request correlation ID, retry count, and a non-sensitive error code. 3. Redact sensitive headers case-insensitively before any request object is serialized. 4. Mask or omit supporter names, email addresses, telephone numbers, mailing addresses, comments, tributes, and custom fields. 5. Ensure exception and HTTP-client middleware cannot automatically dump headers or bodies. 6. Apply least-privilege access controls, short retention periods, encryption, and monitoring to production logs. 7. Use separate API keys with only the permissions required by each integration, and rotate any credential suspected of having entered logs. 8. Add automated tests that submit sentinel secrets and PII, trigger API failures, and verify that none of those values appear in captured logs. A safer replacement would be: ```markdown Log only sanitized API error metadata. Never log authorization headers, portal access links, payment-method identifiers, supporter PII, or complete request/response bodies. ```