nic-6443 opened a new pull request, #13786: URL: https://github.com/apache/apisix/pull/13786
### Description When a kafka send fails, `error-log-logger` built its error string with `core.json.encode(config.kafka.brokers)`, which includes the decrypted `sasl_config.password`. That string is written at ERROR level by the batch processor, which is emitted at the default `warn` log level, so the kafka SASL password leaks into the error log — and this plugin's own purpose is to ship the error log onward. The same broker structure was also logged at INFO on each flush. This redacts the broker list to `host`/`port` only before logging (both the failure error string and the INFO flush line). ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change (no user-facing config/behavior change) - [x] I have verified that this change is backward compatible -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
