25
Our pipeline 'pass' was a lie for 2 days, secrets were sitting in job logs
I found our CI masking regex only worked on stdout, not the debug output we turned on for a SonarQube issue, so AWS keys sat in plain text logs for 48 hours before I caught it. Anyone else doing a log scrub audit after enabling verbose logging?
1 comments
Log in to join the discussion
Log In1 Comment
sandragonzalez2d ago
Three days ago I found my own masking fail, same kind of situation. We turned on debug for a database migration issue and the connection string with the password ended up in the trace logs. The regex was fine for the normal output but the debug logger wrote raw values before any filtering ran. So I get the frustration, but I see it as a process gap, not a tool lie. You trusted the mask to cover every path, and it only covered one. The real fix is to test the scrub on each log level and each output type, not just assume one regex covers everything. That 48 hours probably taught you more than any alert would have.
2