Secret API Key is logged in cleartext

How it was found

Summary:

While code-reviewing the repository https://github.com/omise/omise-python/, I have found that you log in clear-text some sensitive data.

Steps To Reproduce:

1. Check here omise/request.py#L88 and here omise/request.py#L111
2. The code source explicitly logs in debugging mode the secret API key.

logger.debug('Authorization: %s', self.api_key)

1. Activate logging level debug and run the following sample.py file

import omise
omise.api_secret = 'skey_test_5sqdfyjv0rtqzs9f2x2'

customer = omise.Customer.create(
   description='John Doe',
   email='[email protected]'
)

You will get:

{F1857247}

Impact

• sensitive data logged in clear text may end up in unusual places: recorded demonstrations, copied logs, etc.

Remediation

• I suggest you log at least a partial part of the secret API key if not remove the L88 and L111 in whole.