Redact secrets when logging config and warn user when changing categories by seanbudd · Pull Request #19966 · nvaccess/nvda

seanbudd · 2026-04-17T04:12:07Z

Link to issue number:

Closes #19465

Summary of the issue:

Secrets stored in NVDA config are often unintentionally logged in debug mode by NVDA

Description of user facing changes:

logging will attempt to redact secrets when the developer decides to sanitise risky log messages.
Added a new log level: secrets, to disable redactions for required debug logging.
Added a warning whenever selecting a log level below info.

Description of developer facing changes:

A new redactSecrets parameter for logging, which searches for and replaces secrets in the log message.

Description of development approach:

Use https://github.com/Yelp/detect-secrets

This pull request introduces secret redaction support in logging, ensuring that sensitive information is masked in log outputs when requested.
A new log level is added so you can view unredacted logs if needed.

Secret Redaction in Logging

Added a redactSecrets parameter to the Logger._log method in logHandler.py that, when enabled, uses the detect-secrets library to scan and mask detected secrets in log messages.
Updated logging calls in source/config/__init__.py to use redactSecrets=True when logging potentially sensitive configuration data.
Updated the developer documentation to describe the new redactSecrets parameter and recommend its use for sensitive data.

Dependency and Packaging Support

Added detect-secrets as a dependency in pyproject.toml and ensured all relevant submodules are included in frozen builds for dynamic plugin loading
Include multiprocessing in bundle - needed for import, seems to functionally work?

Testing strategy:

Manual testing by putting a secret in my NVDA config.
- installed copy from build
- source copy
Added unit tests for the new secret redaction logic in tests/unit/test_logHandler.py, covering both normal and edge cases.

Known issues with pull request:

Code Review Checklist:

Documentation:
- Change log entry
- User Documentation
- Developer / Technical Documentation
- Context sensitive help for GUI changes
Testing:
- Unit tests
- System (end to end) tests
- Manual testing
UX of all users considered:
- Speech
- Braille
- Low Vision
- Different web browsers
- Localization in other languages / culture than English
API is compatible with existing add-ons.
Security precautions taken.

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> Co-authored-by: Sean Budd <seanbudd123@gmail.com>

Copilot

Pull request overview

This PR introduces an opt-in mechanism to redact detected secrets from log output (notably for config dumps), backed by the detect-secrets dependency, and wires it into config logging plus developer-facing documentation.

Changes:

Add redactSecrets kwarg support to NVDA’s custom Logger._log implementation and perform secret detection/redaction on the formatted message.
Use redactSecrets=True when logging config state during load/upgrade to reduce risk of leaking secrets into logs.
Add detect-secrets==1.5.0 to dependencies/lockfile and document the new logging parameter in the changelog.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`source/logHandler.py`	Adds `redactSecrets` kwarg to `_log` and integrates `detect-secrets` scanning/redaction into the logging path.
`source/config/__init__.py`	Enables redaction for config dump log messages during load/upgrade.
`pyproject.toml`	Adds `detect-secrets` as a runtime dependency.
`uv.lock`	Locks `detect-secrets` and updates dependency lists accordingly.
`source/setup.py`	Ensures `detect_secrets` is included in build packaging (function-scoped import).
`user_docs/en/changes.md`	Documents the new `redactSecrets` logging parameter and its intended usage.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

seanbudd · 2026-04-20T04:53:44Z

huh - seems like the module still isn't being included correctly

… detectSecrets

Co-authored-by: Cyrille Bougot <cyrille.bougot2@laposte.net>

seanbudd · 2026-04-21T07:31:47Z

unit tests are failing

Qchristensen

Changes read well

Link to issue number: Fix-up of #19966 Summary of the issue: #19966 introduces secrets logging level. Though, manually testing, we can see that secrets are never masked, no matter the log level. Description of user facing changes: Secrets are now masked in log for log levels higher than "secrets". Description of developer facing changes: N/A Description of development approach: Fixed comparison logic bug. Also fixed unit tests which passed only by chance in Redact secrets when logging config and warn user when changing categories #19966, setting default test log level to INFO instead of NOTSET

Closes #20125 (discussion) Follow-up of #19966 Summary of the issue: The log level with unredacted secrets was called "secrets". This name was not found to be the most suitable. Description of user facing changes: The lower log level with unredacted secrets is now called "debug (unredacted)" People running alpha / beta who have saved SECRET level as their logging level will have their logging level unrecognized and restored to default (INFO). This is acceptable during alpha/beta phase. Description of developer facing changes: N/A Description of development approach: Updated code. I have not implemented a config upgrade from SECRET to DEBUG_UNREDACTED, since the drawback (level restored to INFO) is acceptable during alpha/beta phase; and implementing a config upgrade step would add just more code to avoid a not very penalizing issue for alpha / early beta tester.

Redact secrets when logging

3175d14

seanbudd changed the title ~~Redact secrets when logging~~ Redact secrets when logging config Apr 17, 2026

github-code-quality Bot found potential problems Apr 17, 2026

View reviewed changes

Comment thread source/logHandler.py Fixed

seanbudd commented Apr 17, 2026

View reviewed changes

Comment thread source/logHandler.py Outdated

seanbudd and others added 5 commits April 17, 2026 14:16

Apply suggestions from code review

e3a0dea

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> Co-authored-by: Sean Budd <seanbudd123@gmail.com>

fix inclusion

a0702a8

fix up detection and formatting

94c1668

Pre-commit auto-fix

520d9bc

document changes

098b3cb

seanbudd marked this pull request as ready for review April 17, 2026 07:15

seanbudd requested a review from a team as a code owner April 17, 2026 07:15

seanbudd requested review from SaschaCowley and Copilot April 17, 2026 07:15

Copilot started reviewing on behalf of seanbudd April 17, 2026 07:15 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Comment thread source/logHandler.py Outdated

Comment thread source/logHandler.py Outdated

Comment thread source/logHandler.py Outdated

Comment thread source/logHandler.py Outdated

Comment thread source/logHandler.py Outdated

seanbudd marked this pull request as draft April 17, 2026 07:27

seanbudd mentioned this pull request Apr 17, 2026

Clean up config logging #19957

Merged

5 tasks

seanbudd and others added 3 commits April 17, 2026 17:39

review suggestions

fb2fe7e

Pre-commit auto-fix

9b266b5

add unit tests

a2551f4

seanbudd marked this pull request as ready for review April 17, 2026 07:46

Pre-commit auto-fix

c15a546

github-code-quality Bot found potential problems Apr 17, 2026

View reviewed changes

Comment thread tests/unit/test_logHandler.py Fixed

seanbudd marked this pull request as draft April 20, 2026 04:53

seanbudd added 2 commits April 20, 2026 17:40

Merge remote-tracking branch 'origin/master' into detectSecrets

86851a5

fix detect_secrets inclusion

f58c1f6

github-code-quality Bot found potential problems Apr 20, 2026

View reviewed changes

Comment thread tests/unit/test_logHandler.py Dismissed

seanbudd requested a review from Copilot April 20, 2026 10:04

Copilot started reviewing on behalf of seanbudd April 20, 2026 10:04 View session

Add help id

43d007b

seanbudd commented Apr 21, 2026

View reviewed changes

Comment thread source/gui/settingsDialogs.py Outdated

Apply suggestion from @seanbudd

ccc6aa2

seanbudd commented Apr 21, 2026

View reviewed changes

Comment thread source/gui/settingsDialogs.py Outdated

Apply suggestion from @seanbudd

00eb8bf

seanbudd commented Apr 21, 2026

View reviewed changes

Comment thread user_docs/en/changes.md

seanbudd added 2 commits April 21, 2026 14:30

restore mathcat?

8f54736

Merge remote-tracking branch 'refs/remotes/origin/detectSecrets' into…

f0c7c4b

… detectSecrets

CyrilleB79 reviewed Apr 21, 2026

View reviewed changes

Comment thread source/logHandler.py Outdated

CyrilleB79 reviewed Apr 21, 2026

View reviewed changes

Comment thread source/logHandler.py Outdated

seanbudd and others added 2 commits April 21, 2026 16:32

Update source/logHandler.py

49b2043

Co-authored-by: Cyrille Bougot <cyrille.bougot2@laposte.net>

Update source/logHandler.py

3924102

Co-authored-by: Cyrille Bougot <cyrille.bougot2@laposte.net>

seanbudd marked this pull request as draft April 21, 2026 07:31

seanbudd added 3 commits April 22, 2026 10:27

line end

7c982ff

Merge remote-tracking branch 'origin/master' into detectSecrets

c71c883

fix ineq

85dab52

seanbudd marked this pull request as ready for review April 22, 2026 00:28

Qchristensen approved these changes Apr 22, 2026

View reviewed changes

Merge remote-tracking branch 'origin/master' into detectSecrets

8a70eba

SaschaCowley approved these changes Apr 22, 2026

View reviewed changes

seanbudd enabled auto-merge (squash) April 22, 2026 05:37

seanbudd disabled auto-merge April 22, 2026 05:49

seanbudd merged commit 42f949f into master Apr 22, 2026
40 of 41 checks passed

seanbudd deleted the detectSecrets branch April 22, 2026 05:50

github-actions Bot added this to the 2026.2 milestone Apr 22, 2026

This was referenced May 19, 2026

Change Secrets logging level name to Debug (unredacted) #20173

Merged

Fix secrets logging #20174

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Redact secrets when logging config and warn user when changing categories#19966

Redact secrets when logging config and warn user when changing categories#19966
seanbudd merged 30 commits into
masterfrom
detectSecrets

seanbudd commented Apr 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seanbudd commented Apr 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seanbudd commented Apr 21, 2026

Uh oh!

Qchristensen left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

seanbudd commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Link to issue number:

Summary of the issue:

Description of user facing changes:

Description of developer facing changes:

Description of development approach:

Testing strategy:

Known issues with pull request:

Code Review Checklist:

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seanbudd commented Apr 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

seanbudd commented Apr 21, 2026

Uh oh!

Qchristensen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

seanbudd commented Apr 17, 2026 •

edited

Loading