log-secret
The server's log never contains a caller's credential
shipped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain log-secret.
- pack
upstreamopt-in pack- weight
- scoredcandidate
- scope
- server (what the harness's upstream stub received from the server, and what the server printed or relayed)
- decided by
- log
- since
- 0.3-draft (methodology 0.3-draft)
- config keys
checks.log-secret.enabledchecks.log-secret.severityidentities.aidentities.bupstream.credential_headerupstream.kind
Probes
logthe server's stdout and stderr, as Sealmark captured them, are searched for either minted token and for the upstream error canary
Settings and thresholds
Every check also takes checks.log-secret.enabled and checks.log-secret.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
identities.a | none | not locked | Token the harness sends as caller A wherever the server config says {bearer} or {bearer:a}. null mints one per run. Set it when the server validates tokens it did not issue. ${VAR} is read from the environment. Treated as a secret: redacted in config show and in reports (flag --identity-a). |
identities.b | none | not locked | Token the harness sends as caller B ({bearer:b}). null mints one per run. Must differ from identities.a. Treated as a secret (flag --identity-b). |
upstream.credential_header | authorization | not locked | Header the upstream-credential check reads the forwarded credential from (compared case-insensitively). |
upstream.kind | none | not locked | Kind of the harness-owned upstream stub the server's backend is pointed at through {upstream}. http starts a loopback stub that records every request the server forwards (flag --upstream). null starts none. The stub needs a server Sealmark starts, and the server must use {upstream} in command, args, env, url, headers or files. |
How the verdict is established
- Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.
What to fix
Keep credentials out of the server's log: redact the Authorization header and any token before a request, a backend call or an error is logged.
False positives
None known for a server Sealmark started or ran over stdio. A server that logs to a file or a collector is not seen.
False negatives
Only the last 1 MiB of output is kept. A server that logs a hash or a truncated token is not seen.