Skip to content

Remove print(key) that leaks secret value to pipeline logs - #196

Open
Manya Sharma (ManyaS-Git) wants to merge 1 commit into
microsoft:masterfrom
ManyaS-Git:fix/remove-secret-leak
Open

Remove print(key) that leaks secret value to pipeline logs#196
Manya Sharma (ManyaS-Git) wants to merge 1 commit into
microsoft:masterfrom
ManyaS-Git:fix/remove-secret-leak

Conversation

@ManyaS-Git

Copy link
Copy Markdown

Summary

.ci/scripts/set_secret.py prints the raw value of storage_conn_string (line 33: print(key)) to stdout before storing it in Azure Key Vault. Because the script is invoked by .ci/steps/deploy_steps.yml:65 and .ci/steps/deploy_steps_v2.yml:77, the secret value is captured in the Azure DevOps pipeline build log — visible to anyone with access to the run.

The print() is debug output; the function's own return message (print(message) on line 36) already confirms success. Removing the single line eliminates the leak with no change to the script's function.

Verification

  • Script syntax validated with py_compile.
  • The only callers pass -n <key-name> via the inline script in deploy_steps.yml; the removed line is standalone with no downstream dependency.
  • Bug confirmed present on upstream microsoft/AI master.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant