[P1] Sensitive user data logged to console and output
Problem
Multiple locations log sensitive user data including full request payloads, user profiles, and taxonomy data to console output. In production, these logs could expose personally identifiable information (PII) and create compliance issues.
Files
-
chatqna/genieai_chatqna.py:1228— Logs full frontend payload:logger.info(f"FRONTEND PAYLOAD: \n{data}") -
chatqna/genieai_chatqna.py:1247— Logs parsed chat request with all user data -
chatqna/genieai_chatqna.py:345-351— Prints full taxonomy labels to stdout -
dataprep/genieai_dataprep_arangodb.py:110-126— Prints all env vars including URLs to stdout -
dataprep/genieai_dataprep_arangodb.py:348— Prints taxonomy and file labels to stdout
Acceptance Criteria
-
Remove or redact full request payload logging in production -
Use structured logging with appropriate log levels (DEBUG for detailed data) -
Mask PII fields (email, phone, name) before logging -
Replace print()calls with the structured CustomLogger -
Ensure LOGFLAG=falsesuppresses all verbose output