HansMarcus01 commented on PR #39177: URL: https://github.com/apache/beam/pull/39177#issuecomment-5259998738
Note: The "Clear-text logging of sensitive information" warning flagged on this file is a false positive.CodeQL's heuristics flagged the variables secret, secret_name, and managed_secrets. However, these variables exclusively store the GCP Secret Manager resource identifiers (names/IDs), not the actual cryptographic payloads or sensitive data. The actual secret payloads are securely handled in a separate method (_get_verified_keys_from_secret_manager) and are never passed to the logger. Logging resource names is standard practice and strictly necessary for infrastructure auditing and debugging. Since no sensitive data is being exposed in plain text, I suggest we dismiss or ignore this specific alert. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
