http auth token occasionally leaked
Metadata
Current evaluation
Triaged security bug: short-lived Launchpad HTTP tokens can appear in remote-build git failure logs; current code still streams unsanitized git output.
Suggested action: keep open
Reason: The maintainer confirmed that git error output, rather than the debug URL, can expose the token and identified censoring the git error as the needed fix. Current code calls push_url without its token-sanitization argument and logs subprocess stdout/stderr verbatim; the five-minute token lifetime limits impact, but retained CI logs can still expose credentials.
Evaluated by: mr-cal-bot
Impact:
64
Quick Win:
37
Complexity:
34
Confidence:
94
Actionability:
88
Issue body
### Bug Description
Hello, the logging can occasionally leak http auth tokens "in the clear". While these may not have the same value as a full password or key, it'd still be nice if they weren't logged.
### To Reproduce
`snapcraft remote-build` in a CI system was reported to have this problem.
### part yaml
```shell
```
### Relevant log output
```shell
Writing objects: 100% (25/25), 1.64 GiB | 12.60 MiB/s, done.
Total 25 (delta 2), reused 3 (delta 0), pack-reused 0
error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly
Everything up-to-date
Failed to execute git command: git -C
/home/redacted/.local/share/snapcraft/remote-build/snapcraft-juju-redacted/repo push
'https://redacted:TOKEN REDACTED@git.launchpad.net/~redacted/[snip]
HEAD:master --force
Recommended resolution:
Consider checking your git configuration for settings which may cause issues.
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
64
Quick Win:
37
Complexity:
34
Confidence:
94
Actionability:
88
|
keep open | Triaged security bug: short-lived Launchpad HTTP tokens can appear in remote-build git failure logs; current code still streams unsanitized git output. | |
| stealth/space-bunny-alpha |
Impact:
66
Quick Win:
49
Complexity:
18
Confidence:
95
Actionability:
90
|
keep open | Triaged security bug: remote-build can expose a Launchpad HTTP token in git push errors because GitRepo.push_url does not receive the token needed for redaction; remains open and unfixed. | |
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
22
Complexity:
30
Confidence:
80
Actionability:
80
|
keep open | HTTP auth token occasionally leaked in logs during `snapcraft remote-build` git push failures. The code sanitizes the URL in Craft error messages but logs raw git output which may contain the token. | |
| qwen/qwen3.8-27b |
Impact:
70
Quick Win:
38
Staleness:
55
Complexity:
45
Confidence:
75
Support Request:
5
|
keep open | Remote-build git push can leak the Launchpad access token in error logs. Triaged as a bug; fix identified as censoring the token from git's error output, but no fix commit found yet. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
85
Complexity:
25
Confidence:
90
Support Request:
5
|
keep open | Valid bug report detailing HTTP auth token leakage in git error logs during snapcraft remote-build. Triaged and identified by maintainers, but inactive for over a year. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
85
Complexity:
15
Confidence:
80
Support Request:
0
|
keep open | Bug where HTTP auth tokens are logged in plain text during snapcraft remote-build git operations. Triaged and acknowledged by maintainers, but inactive for over a year. |
Update history
No update history recorded yet.
Related issues
No related issues found above the similarity threshold.