---
id: w6/m6/t005
title: Secrets-hygiene audit — logs and error paths
worker: worker6
status: done
estimate: 30m
depends_on: []
---

## Objective

Grep bex-api and operator logging/error paths for leaked credentials: OpenBao tokens, DB URIs, API keys, the webhook secret.

## Context

- `BEX_OPENBAO_URL`/tenant secrets, `BEX_CP_DB_URI`, API keys (Hydra-issued), `BEX_WEBHOOK_SECRET` are all sensitive values that could leak via `log.Printf`/error wrapping if a value is interpolated directly instead of redacted.

## Steps

1. Grep `lego/backend/` and `lego/operator/` for logging calls (`log.`, `slog.`, `fmt.Errorf` wrapping) near any of the sensitive env vars / secret-bearing structs.
2. For each hit, confirm the secret value itself is never logged (only presence/absence, or a redacted form).
3. Fix any leak found; add a redaction helper if a pattern of risk repeats.
4. Record findings for t007.

## Files

- `lego/backend/internal/**`
- `lego/operator/internal/**`

## Acceptance criteria

- [ ] No log statement or error message contains a raw secret value.
- [ ] Any leak found is fixed.

## Out of scope

- Log storage/retention security (Loki access control) — that's `docs/ADR010-observability.md` territory, not this audit.
