Skip to content

fix: redact credentials in llm connection and provider logs #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
sjvans wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

fix: redact credentials in llm connection and provider logs #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@

### Fixed

- Credentials are no longer exposed in logs when connecting to the `llm` service or instantiating an LLM provider; both now redact via `cds.utils.redacted()`

@Akatuoro Akatuoro Oct 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changelog entry is misleading. We do not redact more now, we just switch to cds.utils.redacted

- Correctly handle non `@cap-js/mcp` tools during PII masking
- Correctly report A2A messages as failed when AI Core is configured but no AI Core credentials can be found
- Correctly report input tokens for Anthropic models on AI Core. OpenTelemetry specifies that input_tokens includes cached tokens, but Anthropic did not include the cached tokens in input_tokens
Expand Down
11 changes: 2 additions & 9 deletions cds-plugin.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,15 +83,8 @@ cds.on("bootstrap", (app) => {
cds.env.requires.llm = resolve_openai_config(cds.requires.llm)
}

const config = cds.requires.llm,
credentials = {}
const { url, destination, anthropicApiUrl, baseURL, apiKey } = config?.credentials || {}
if (url) credentials.url = url
if (destination) credentials.destination = destination
if (anthropicApiUrl) credentials.anthropicApiUrl = anthropicApiUrl
if (baseURL) credentials.baseURL = baseURL
if (apiKey) credentials.apiKey = "***"
LOG.info(`cds.connect.to 'llm' with:`, { ...config, credentials })
const config = cds.requires.llm
LOG.info(`cds.connect.to 'llm' with:`, cds.utils.redacted(config))

@Akatuoro Akatuoro Oct 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The output is less helpful now...
Before:

[agents] - cds.connect.to 'llm' with: {
  kind: 'anthropic',
  model: 'claude-sonnet-4-6',
  credentials: {
    anthropicApiUrl: 'http://localhost:6655/anthropic/',
    apiKey: '***'
  }
}

Now:

[agents] - cds.connect.to 'llm' with: {
  kind: 'anthropic',
  model: 'claude-sonnet-4-6',
  credentials: { anthropicApiUrl: '...', apiKey: '...' }
}

The url is usually something that I want to know

@sjvans sjvans Oct 2, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes sense. i'll take that as feedback for redacted. no need to proceed with this until then.

})
})()

Expand Down
4 changes: 1 addition & 3 deletions srv/handlers/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,9 +99,7 @@ export default function registerDefaultAgentHandlers(srv) {
if (!impl) impl = cds.requires.kinds[kind]?.impl
if (!impl) throw new Error("No service implementation found for " + name)
const { default: LLMProvider } = await import(impl)
const { credentials, ...o } = options
if (credentials) o.credentials = '{ *** }'
LOG.debug (`Creating LLMProvider instance for cds.requires.${name} with options:`, o)
LOG.debug (`Creating LLMProvider instance for cds.requires.${name} with options:`, cds.utils.redacted(options))
return new LLMProvider(name, { ...options, ...req.data })
})

Expand Down
Loading