fix(sanitization): secret exposure in function and agent trace spans by BillLeoutsakosvl346 · Pull Request #6000 · simstudioai/sim

BillLeoutsakosvl346 · 2026-07-28T05:36:28Z

What changed

Added an environment-aware sanitizer that restores configured {{ENV_VAR}} references in trace/display values, including nested tool calls, timing segments, errors, object keys, and URL-encoded values.
Preserved unresolved environment references in Function display/error source while continuing to resolve plaintext runtime code.
Applied sanitization at the BlockExecutor observability boundary without changing handler inputs, runtime state, handled errors, retries, or resume execution.
Registered the sanitizer at the workflow logging boundary so Overview final output, synthetic errors, fallbacks, final spans, and telemetry copies are also sanitized.
Prevented streaming completion and human-in-the-loop resume paths from reintroducing raw values into already-sanitized logs.
Kept raw outputs available for API responses, downstream execution, retry/resume state, and billing calculations.

Root cause

Block inputs and provider/tool outputs were logged after environment references had been resolved. Function display code also resolved environment values, and post-executor paths could overwrite sanitized logs with raw streaming, pause-state, or workflow final-output data immediately before persistence.

Impact

New trace spans and Overview workflow output show configured references such as {{AWS_SECRET_ACCESS_KEY}} instead of plaintext values. Runtime tool/function execution, API responses, downstream block behavior, billing, retries, pause/resume, and persisted runtime state remain unchanged. Existing historical logs are not rewritten.

Validation

Independent senior review with a second review after addressing all findings
216 targeted Vitest tests across sanitizer, resolver, BlockExecutor, execution core, logging completion, trace spans, Function handler, snapshots, streaming, and HITL resume
App TypeScript check
Targeted Biome lint/format on all changed files
API validation contract audit
git diff --check

vercel · 2026-07-28T05:36:36Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 1, 2026 7:08pm

BillLeoutsakosvl346 · 2026-07-28T05:37:33Z

@greptile

BillLeoutsakosvl346 · 2026-07-28T05:37:34Z

@cursor review

cursor · 2026-07-28T05:37:43Z

PR Summary

High Risk
Touches secret handling, authentication boundaries for private provenance metadata, and broad execution/logging paths; incorrect masking or provenance could leak secrets or break observability, though design fails closed when provenance is incomplete.

Overview
Introduces execution log protection: when a value from Settings → Secrets is successfully substituted through {{KEY}}, exact case-sensitive occurrences are masked in log-facing content (live block console, Logs Overview, stored traces, v1 log APIs, export, Logs block Get Run Details), usually as {{KEY}}. Runtime behavior is unchanged—blocks, tools, and workflow responses still receive real values; only observability projections and read APIs get a protected copy.

Provenance is tracked so masking knows which plaintexts to replace: the Function execute API reports __resolvedSecretNames only for successful {{KEY}} resolution from scoped env vars (not direct environmentVariables or shell $VAR alone), gated by an internal request header. MCP tool execution and Mothership execute attach encrypted __resolvedSecretTraceProvenance only to internal JWT callers that request it; session and external callers never see it. Workflow execute can return the same provenance on JSON responses for internal tool callers.

Workflow execute projects masked display fields on SSE block events, stream chunks, and terminal errors; materializes logs for display via materializeExecutionDataForDisplay. Session users can retry with inputFromExecutionId (server loads stored input without returning it to the client) and run from block using trusted stored execution state with sourceExecutionId. Legacy workflow log completion restores trusted provenance from stored execution state before building traces.

UI retry uses executionId instead of extracting input from log detail; the editor honors server display for agent thinking and reconciles final block logs to masked terminal content.

Docs add Execution log protection under Secrets and update agents, MCP, logs, Function, and variables pages with scope and limitations (not a general redactor; encoded/transformed values not matched).

^{Reviewed by Cursor Bugbot for commit c9302a5. Configure here.}

greptile-apps · 2026-07-28T05:40:35Z

Greptile Summary

This PR stops resolved environment secrets from appearing in workflow trace spans and Overview logs while keeping runtime execution and API payloads unchanged.

Adds ResolvedSecretTraceRegistry plus Aho–Corasick-style projection (trace-secret-projection) to restore {{ENV_VAR}} (or anonymous redaction) in display traces.
Activates secrets only on successful {{NAME}} resolution; carries encrypted provenance across internal boundaries (MCP, function execute, mothership, nested workflows, HITL resume).
Applies projection at logging completion / execution-core boundaries; avoids re-injecting raw values from streaming completion and HITL resume into already-sanitized logs.
Leaves handler inputs, retries, billing, and downstream block state on raw resolved values; adds extensive Vitest coverage across sanitizer, registry, executor, logging, and streaming paths.

Confidence Score: 5/5

No prior Greptile findings remain to re-score and no eligible follow-up inline comments were identified, so the PR appears safe to merge from this pass.

No blocking failure remains from outstanding prior threads or newly eligible incomplete-fix findings in this follow-up review.

Important Files Changed

Filename	Overview
apps/sim/executor/utils/resolved-secret-trace-registry.ts	New catalog/active-match registry with encrypted provenance, scope checks, and bounded export-for-value filtering for cross-boundary secret tracking.
apps/sim/lib/logs/execution/trace-secret-projection.ts	Terminal projection that rewrites secret literals in trace trees (including large-value refs) without mutating runtime block state.
apps/sim/lib/logs/execution/logger.ts	Completes logs with prepared/projected spans, preserves private provenance on PII-masked execution state, and adjusts size compaction of tool-call content.
apps/sim/executor/variables/resolvers/env.ts	Records resolved env secrets into the trace registry only when the name exists on execution environment variables.
apps/sim/lib/workflows/executor/execution-core.ts	Wires registry creation and trace projection into the main workflow execution completion path.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  EnvResolve["EnvResolver.recordResolved"] --> Registry["ResolvedSecretTraceRegistry"]
  Nested["MCP / function / mothership / nested WF"] --> Prov["Encrypted provenance import/export"]
  Prov --> Registry
  Runtime["Raw block I/O for execution"] --> Logs["buildTraceSpans / completeWorkflowExecution"]
  Registry --> Project["projectTraceSpansForSecrets"]
  Logs --> Project
  Project --> Persist["Persisted executionData.traceSpans"]
  Project --> Overview["Overview / export / UI logs"]

_{Reviews (5): Last reviewed commit: "secrets sanitization correctness" | Re-trigger Greptile}

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 95d4fd1. Configure here.}

BillLeoutsakosvl346 · 2026-07-28T06:24:01Z

@greptile

BillLeoutsakosvl346 · 2026-07-28T06:24:02Z

@cursor review

BillLeoutsakosvl346 · 2026-07-28T06:34:24Z

@greptile please review the latest commit, including the workflow-overview sanitization follow-up and the streaming token-accounting correction.

BillLeoutsakosvl346 · 2026-07-28T06:34:25Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e73afbe. Configure here.}

BillLeoutsakosvl346 · 2026-07-28T07:01:35Z

Demo:

Screen.Recording.2026-07-28.at.12.00.01.AM.mov

…zation-trace-spans # Conflicts: # apps/sim/lib/logs/execution/logging-session.ts

…zation-trace-spans

gitguardian · 2026-08-01T03:08:58Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
35187658	Triggered	Username Password	`64f791f`	apps/desktop/src/main/browser-credentials/vault.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

icecrasher321 · 2026-08-01T03:15:36Z

bugbot run

icecrasher321 · 2026-08-01T03:15:40Z

@greptile

icecrasher321 · 2026-08-01T17:23:22Z

@cursor review

icecrasher321 · 2026-08-01T17:23:22Z

@greptile

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2eb706a. Configure here.}

icecrasher321 · 2026-08-01T17:28:59Z

@greptile

…zation-trace-spans

icecrasher321 · 2026-08-01T19:03:51Z

@greptile

icecrasher321 · 2026-08-01T19:03:57Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c9302a5. Configure here.}

icecrasher321 · 2026-08-01T19:10:26Z

@greptile please review the final commit c9302a5, including the execution-state preservation follow-up.

fix trace span secret sanitization

95d4fd1

cursor Bot reviewed Jul 28, 2026

View reviewed changes

BillLeoutsakosvl346 marked this pull request as ready for review July 28, 2026 05:44

sanitize workflow output logs

55814db

vercel Bot temporarily deployed to Preview July 28, 2026 06:23 Inactive

cursor Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread apps/sim/lib/workflows/streaming/streaming.ts Outdated

preserve streaming usage estimates

e73afbe

vercel Bot temporarily deployed to Preview July 28, 2026 06:34 Inactive

cursor Bot reviewed Jul 28, 2026

View reviewed changes

icecrasher321 changed the title ~~Fix secret exposure in function and agent trace spans~~ fix(sanitization): secret exposure in function and agent trace spans Jul 31, 2026

icecrasher321 added 6 commits July 31, 2026 13:02

Merge remote-tracking branch 'origin/staging' into fix/secrets-saniti…

64f791f

…zation-trace-spans # Conflicts: # apps/sim/lib/logs/execution/logging-session.ts

Fix logging session test after staging merge

9754d5f

Merge remote-tracking branch 'origin/staging' into fix/secrets-saniti…

664de15

…zation-trace-spans

Merge remote-tracking branch 'origin/staging' into fix/secrets-saniti…

254945f

…zation-trace-spans

Merge remote-tracking branch 'origin/staging' into fix/secrets-saniti…

8b6f795

…zation-trace-spans

secrets sanitization correctness

0acc905

cursor Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread apps/sim/app/api/workflows/[id]/execute/route.ts

Comment thread apps/sim/hooks/queries/logs.ts

Comment thread apps/sim/app/workspace/[workspaceId]/w/[workflowId]/hooks/use-workflow-execution.ts

vercel Bot deployed to Preview August 1, 2026 03:14 View deployment

cursor Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread apps/sim/app/api/mcp/tools/execute/route.ts

Comment thread apps/sim/app/api/workflows/[id]/execute/route.ts

fix(execution): address review regressions

2eb706a

vercel Bot temporarily deployed to Preview August 1, 2026 17:22 Inactive

cursor Bot reviewed Aug 1, 2026

View reviewed changes

icecrasher321 added 5 commits August 1, 2026 11:04

Merge remote-tracking branch 'origin/staging' into fix/secrets-saniti…

9f32e2c

…zation-trace-spans

fix(execution): harden secret trace provenance

ce17404

Merge remote-tracking branch 'origin/staging' into fix/secrets-saniti…

104ddf2

…zation-trace-spans

Merge remote-tracking branch 'origin/staging' into fix/secrets-saniti…

be7408a

…zation-trace-spans

fix(execution): preserve functional state during trace projection

c9302a5

cursor Bot reviewed Aug 1, 2026

View reviewed changes

vercel Bot deployed to Preview August 1, 2026 19:08 View deployment

Uh oh!

Conversation

BillLeoutsakosvl346 commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Root cause

Impact

Validation

Uh oh!

vercel Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Jul 28, 2026

Uh oh!

BillLeoutsakosvl346 commented Jul 28, 2026

Uh oh!

cursor Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

BillLeoutsakosvl346 commented Jul 28, 2026

Uh oh!

BillLeoutsakosvl346 commented Jul 28, 2026

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Jul 28, 2026

Uh oh!

BillLeoutsakosvl346 commented Jul 28, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

BillLeoutsakosvl346 commented Jul 28, 2026

Uh oh!

gitguardian Bot commented Aug 1, 2026

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

icecrasher321 commented Aug 1, 2026

Uh oh!

icecrasher321 commented Aug 1, 2026

Uh oh!

Uh oh!

Uh oh!

icecrasher321 commented Aug 1, 2026

Uh oh!

icecrasher321 commented Aug 1, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

icecrasher321 commented Aug 1, 2026

Uh oh!

icecrasher321 commented Aug 1, 2026

Uh oh!

icecrasher321 commented Aug 1, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

icecrasher321 commented Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

BillLeoutsakosvl346 commented Jul 28, 2026 •

edited

Loading

vercel Bot commented Jul 28, 2026 •

edited

Loading

cursor Bot commented Jul 28, 2026 •

edited

Loading

greptile-apps Bot commented Jul 28, 2026 •

edited

Loading