Description: Enabling global debug logging via an environment variable (SE_DEBUG/SELENIUM_VERBOSE) can
cause sensitive data (e.g., credentials, session tokens, URLs with secrets, internal
hostnames) to be written to stderr/console in production if the env var is set or
inherited unintentionally; similar debug-enablement behavior is also introduced in
py/selenium/webdriver/init.py,
dotnet/src/webdriver/Internal/Logging/LogContextManager.cs, rb/lib/selenium/webdriver.rb,
and java/src/org/openqa/selenium/internal/Debug.java.
logging.js [485-489]

// Enable debug logging if SE_DEBUG or SELENIUM_VERBOSE environment variable is set
if (typeof process !== 'undefined' && process.env && (process.env.SE_DEBUG || process.env.SELENIUM_VERBOSE)) {
  logManager.root_.setLevel(Level.ALL)
  logManager.root_.addHandler(consoleHandler)
}

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Debug logging exposure: Enabling root logger at Level.ALL and adding a console handler when
SE_DEBUG/SELENIUM_VERBOSE is set may cause sensitive data to be emitted to stderr/console
depending on what downstream log statements include, requiring verification that
secrets/PII are never logged even at debug/trace levels.

// Enable debug logging if SE_DEBUG or SELENIUM_VERBOSE environment variable is set
if (typeof process !== 'undefined' && process.env && (process.env.SE_DEBUG || process.env.SELENIUM_VERBOSE)) {
  logManager.root_.setLevel(Level.ALL)
  logManager.root_.addHandler(consoleHandler)
}

Learn more about managing compliance generic rules or creating your own custom rules

In Debug.java, check if the SE_DEBUG environment variable is a non-empty string
instead of parsing it as a boolean, to align with implementations in other
languages in this PR.

java/src/org/openqa/selenium/internal/Debug.java [30]

-boolean envVar = Boolean.parseBoolean(System.getenv("SE_DEBUG"));
+String seDebug = System.getenv("SE_DEBUG");
+boolean envVar = seDebug != null && !seDebug.isEmpty();

• Apply / Chat

Parse SE_DEBUG/SELENIUM_VERBOSE explicitly (e.g., accept only "1"/"true") and
trim values; this avoids enabling debug when the variable is set to "0"/"false"
or whitespace.

javascript/selenium-webdriver/lib/logging.js [485-489]

 // Enable debug logging if SE_DEBUG or SELENIUM_VERBOSE environment variable is set
-if (typeof process !== 'undefined' && process.env && (process.env.SE_DEBUG || process.env.SELENIUM_VERBOSE)) {
+const isTruthyEnv = (name) => {
+  const v = process?.env?.[name]
+  return typeof v === 'string' && /^1|true$/i.test(v.trim())
+}
+
+if (typeof process !== 'undefined' && process.env && (isTruthyEnv('SE_DEBUG') || isTruthyEnv('SELENIUM_VERBOSE'))) {
   logManager.root_.setLevel(Level.ALL)
   logManager.root_.addHandler(consoleHandler)
 }

• Apply / Chat

 if os.environ.get("SE_DEBUG"):
-    logging.getLogger("selenium").setLevel(logging.DEBUG)
-    if not logging.getLogger("selenium").handlers:
-        logging.getLogger("selenium").addHandler(logging.StreamHandler())
+    logger = logging.getLogger("selenium")
+    logger.setLevel(logging.DEBUG)
+    if not logger.handlers:
+        logger.addHandler(logging.StreamHandler())

In init.py, store the result of logging.getLogger("selenium") in a variable
to avoid repeated calls and improve readability.

py/selenium/webdriver/init.py [22-25]

+logger = logging.getLogger("selenium")
 if os.environ.get("SE_DEBUG"):
-    logging.getLogger("selenium").setLevel(logging.DEBUG)
-    if not logging.getLogger("selenium").handlers:
-        logging.getLogger("selenium").addHandler(logging.StreamHandler())
+    logger.setLevel(logging.DEBUG)
+    if not logger.handlers:
+        logger.addHandler(logging.StreamHandler())

[Suggestion processed]