GHSA-q749-wr8p-6pc9: 
Python vulnerability analysis and mitigation

Summary

An Insertion of Sensitive Information into Log File (CWE-532) vulnerability in AI Agent trace loggers and OpenTelemetry exporters dumps raw HTTP Authorization: Bearer sk-... headers, OPENAI_API_KEY, ANTHROPIC_API_KEY, and GITHUB_TOKEN environment variables into unencrypted log files and public observability dashboards when tool execution fails.

Proof of Concept (PoC)

logger.error(f"Tool call failed with env={os.environ} and headers={request.headers}")

Remediation

Implement a structured regex secret-redaction filter on all log records and telemetry spans before serialization.