From 35b908febb225dbcd658c63e0043d4136bd07179 Mon Sep 17 00:00:00 2001 From: Zinadin Zidan Date: Fri, 30 Oct 2026 23:56:36 +0600 Subject: [PATCH] update: only ureq's Trace logs print the GitHub token (#391) ureq 3.5's Debug request log lists an allow-list of safe headers and leaves Authorization out; the unredacted wire is its Trace output (ureq-proto's log_data). `Http::with_github_token` now says so: apps should redact Bearer tokens or keep `ureq` and `ureq_proto` at Debug or quieter. Co-Authored-By: Claude Opus 5.5 --- crates/update/src/http.rs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/crates/update/src/http.rs b/crates/update/src/http.rs index 44846cd1..fef1ef13 100644 --- a/crates/update/src/http.rs +++ b/crates/update/src/http.rs @@ -132,9 +132,10 @@ impl Http { /// An optional token raises GitHub's limit from 60 to 5000 requests an hour. Only ever sent /// to api.github.com. Blank means none. /// - /// ureq's debug and trace logs print request headers, this token's `Authorization: Bearer` - /// among them: an app that sets one should redact Bearer tokens in its logger, or keep - /// `ureq` and `ureq_proto` below Debug. + /// ureq's Debug logs list only an allow-list of safe headers and leave `Authorization` out, + /// but its Trace logs are the unredacted wire, this token's `Authorization: Bearer` among it: + /// an app that sets one should redact Bearer tokens in its logger, or keep `ureq` and + /// `ureq_proto` at Debug or quieter. #[must_use] pub fn with_github_token(mut self, token: Option) -> Self { self.token = token.map(|t| t.trim().to_string()).filter(|t| !t.is_empty());