You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
License keys are not kept out of logs, and the data update messages name the URL that carries them #51
The URL a data update request is sent to carries the license keys in its query. The data update logging section gives messages that name that URL, such as "Checking for update from '<url>'" (lines 399 to 401) and the connection and download errors (lines 417 to 418). The logging feature says nothing about credentials. Following the specification therefore writes the license keys to the log.
The .NET pipeline logs the URL with the keys at Information level on every check (DataUpdateService.cs line 1192). The Java pipeline logs it at debug level on every download and at error level on every failed one (DataUpdateServiceDefault.java lines 595 to 640). The Rust SDK put them in its error messages.
What is needed
The logging feature to say a license key never appears in a log entry or an error message, and that a message naming a URL that carries one names it with the key removed or replaced.
The data update logging section to say the same of its <url>.
Fixed on main (6570727, #134): logging.md line 20 says "A license key MUST NOT appear in full in a log entry or in an error message", lines 33 and 34 cover URLs, and data-updates.md lines 438 to 442 cover the data update URL.
Activity
jwrosewell commentedon Nov 13, 2026
Fixed on main (6570727, #134): logging.md line 20 says "A license key MUST NOT appear in full in a log entry or in an error message", lines 33 and 34 cover URLs, and data-updates.md lines 438 to 442 cover the data update URL.