T09 · Insecure Skill Coding Practices
- Location
SKILL.md:554- Finding
Unredacted API Request Logging May Expose Credentials and Donor Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:554
Supporting Locations:SKILL.md:568-595,SKILL.md:611-638,SKILL.md:651-681
Vulnerability Type: Sensitive information exposure through unsafe logging guidance
Risk Level: MediumVulnerable Code Snippet
markdown ### Best Practices 1. Implement exponential backoff for rate limits 2. Log all API errors with request details 3. Validate data before sending to API 4. Handle null values gracefully 5. Check for finalized fees using Events endpointThe request details covered by this instruction may contain sensitive headers and payload fields:
python headers = { 'Authorization': f'Bearer {API_KEY}', 'Accept': 'application/json', 'Content-Type': 'application/json' } def create_donation(campaign_id, amount, currency, payment_method_id, supporter): url = f'{BASE_URL}/donations' data = { 'campaign_id': campaign_id, 'amount': str(amount), 'currency': currency, 'payment_method_id': payment_method_id, 'supporter': supporter } response = requests.post(url, headers=headers, json=data) response.raise_for_status() return response.json()Technical Analysis
The skill instructs implementers to log all API errors “with request details” without defining a redaction policy. FundraiseUp requests include a bearer API credential in the
Authorizationheader. Donation request bodies can also include Stripe payment-method identifiers and supporter names, email addresses, telephone numbers, and mailing addresses.Error handlers frequently serialize HTTP request headers, bodies, exception objects, or client-library request configurations. Following this guidance literally could therefore write reusable credentials and donor personally identifiable information to application logs. Logs commonly have broader readership and longer retention tha ...[truncated 2091 chars]
- Remediation
View remediation
Remediation Suggestions
Replace the broad logging instruction with an explicit structured-logging and redaction policy:
- Never log
Authorization, cookies, API keys, donor-portal access URLs or tokens, Stripe payment-method identifiers, or complete request and response bodies. - Log only allowlisted diagnostic fields, such as the HTTP status code, sanitized endpoint template, request correlation ID, retry count, and a non-sensitive error code.
- Redact sensitive headers case-insensitively before any request object is serialized.
- Mask or omit supporter names, email addresses, telephone numbers, mailing addresses, comments, tributes, and custom fields.
- Ensure exception and HTTP-client middleware cannot automatically dump headers or bodies.
- Apply least-privilege access controls, short retention periods, encryption, and monitoring to production logs.
- Use separate API keys with only the permissions required by each integration, and rotate any credential suspected of having entered logs.
- Add automated tests that submit sentinel secrets and PII, trigger API failures, and verify that none of those values appear in captured logs.
A safer replacement would be:
markdown Log only sanitized API error metadata. Never log authorization headers, portal access links, payment-method identifiers, supporter PII, or complete request/response bodies.- Never log