Maker API debug logging writes access token to hub logs in plaintext

Built-In Apps and Drivers
1

With "Enable logging for debugging" turned on, the Maker API app writes its full API URL (including the access_token query parameter) in plaintext to the hub's Past Logs.

To try it:

  1. Enable "Enable logging for debugging".
  2. Trigger any Maker API activity.
  3. Open Logs > Past Logs: the "Testing URL is ..." debug line contains the full URL with access_token in plaintext.

Is this a security problem? When I noticed, I figured I'd rotate the token, but I don't have any reason to think my Logs have been compromised. I started wondering, what if my Logs get exposed unknowingly, bad guys get my token, and they use it to monitor my hub's activity through the Marker API? Probably won't happen, but could it be avoided by not putting the token in the Logs? I turned debugging off just in case...

1 Like