Key-Name Secret Masking
Relevant source files
The following files were used as context for generating this wiki page:
Key-Name Secret Masking is a security feature within the infrahub-collect tool that prevents plaintext secrets from appearing in troubleshooting bundles. The system identifies sensitive information by performing a case-insensitive substring match on key names within environment variables and configuration dumps. When a match occurs, the system replaces the corresponding value with a masked string (********).
Sources: dev/adr/0004-key-name-secret-masking.md:1-12, specs/archive/003-collect-tool/research.md:R5
Architecture and Logic
The masking system operates as a pure function located in src/internal/app/masking.go. This design creates a single "choke-point" through which all sensitive data dumps must pass before being written to the support bundle archive. The implementation uses a centralized token list to identify keys that potentially hold credentials.
Sources: dev/adr/0004-key-name-secret-masking.md:14-23, specs/archive/003-collect-tool/research.md:R5
Masking Data Flow
The following diagram illustrates how raw diagnostic data from various services is routed through the masking function before being stored in the bundle.
This flow ensures that diagnostic information from Infrahub components is sanitized consistently.
Sources: dev/adr/0004-key-name-secret-masking.md:14-23, specs/archive/003-collect-tool/tasks.md:T005
Masking Criteria
The system identifies secrets using a specific set of case-insensitive tokens. The implementation uses pass instead of password to ensure catch-all protection for related keys like requirepass or default_pass.
| Token | Target Identification |
|---|---|
pass | Matches password, passphrase, db_pass, etc. |
secret | Matches api_secret, client_secret, etc. |
token | Matches auth_token, access_token, etc. |
key | Matches api_key, ssh_key, signing_key, etc. |
Sources: dev/adr/0004-key-name-secret-masking.md:18-23, specs/archive/003-collect-tool/research.md:R5
Implementation Details
The system enumerates specific diagnostic outputs that must be routed through the masking logic. This prevents future collectors from accidentally leaking plaintext secrets by bypassing the security layer.
Enumerated Masking Points
- Infrahub Server Environment: Environment variables captured via the
envcommand. - Server API Configuration: Nested JSON configuration dumps from the server API.
- Redis Configuration: Output from the
CONFIG GET '*'command. - RabbitMQ Status: Diagnostics from
rabbitmqctl environmentandrabbitmqctl status.
Sources: dev/adr/0004-key-name-secret-masking.md:18-23, specs/archive/003-collect-tool/research.md:R5
Functionality Mapping
The infrahub-collect tool utilizes specific internal functions to handle different data formats during the collection process.
Limitations and Constraints
The masking system is designed for high reliability through simplicity, leading to specific operational constraints:
- Key-Based Only: The system does not scrub secret patterns (like regex for tokens) inside raw service logs. Logs are written as-is to preserve parity with previous tools.
- Value-Embedded Secrets: Credentials embedded within a value under a non-matching key (e.g., a connection string
DB_URL=postgres://user:password@host) are not currently masked. - Over-masking: Any key containing the identifying tokens is masked, even if it does not contain a sensitive value. This is accepted as a safe failure mode.
Sources: dev/adr/0004-key-name-secret-masking.md:25-36, specs/archive/003-collect-tool/research.md:R5, specs/archive/003-collect-tool/critiques/critique-20260703-170700.md:E3
Summary
Key-Name Secret Masking provides a centralized security mechanism for the infrahub-collect troubleshooting tool. By enforcing a single choke-point for data sanitization based on a robust list of key-name tokens, the project ensures that diagnostic bundles shared with support personnel do not contain plaintext credentials while maintaining the integrity of raw service logs for debugging.
Sources: dev/adr/0004-key-name-secret-masking.md, AGENTS.md:Architecture