RockteMQ-AI commented on issue #10950: URL: https://github.com/apache/rocketmq/issues/10950#issuecomment-5394915742
**Issue Evaluation** Category: `bug` | Status: **Confirmed** Valid security concern. Configuration logging that outputs sensitive values (passwords, tokens, secret keys) to stdout/log files is a real risk — especially in containerized environments where logs are often collected centrally. **Root Cause:** Proxy and Broker startup/shutdown paths log full configuration objects without masking sensitive fields. **Impact:** Any operator or log-aggregation system with access to logs can see credentials in plaintext. **Severity:** Medium-High (security) **Suggested approach:** - Maintain a set of known sensitive field names (e.g., `password`, `secretKey`, `accessKey`, `token`). - Apply masking (`****`) when serializing config objects for logging. - Consider a centralized `ConfigPrinter` utility that respects a `@Sensitive` annotation or field-name allowlist. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
