You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When launching Phoenix using px.launch_app(use_temp=False), error logs display the full PostgreSQL connection string, including credentials in plain text. This poses a security risk, as credentials could be leaked in logs, especially in shared environments or CI/CD pipelines.
Example of the log output:
`ERROR: Application startup failed. Exiting.
🌍 To view the Phoenix app in your browser, visit http://localhost:6006/
💽 Your data is being persisted to postgresql://postgres:pass@host-url:5432/data-warehouse
📖 For more information on how to use Phoenix, check out https://docs.arize.com/phoenix
(Note: The credentials in this message have been manually replaced, but they appear in plaintext in the actual logs.)
To Reproduce
Steps to reproduce the behavior:
1. Configure Phoenix to use a PostgreSQL database.
2. Set up environment variables, including the database URL (PHOENIX_SQL_DATABASE_URL).
3. Start the application using px.launch_app(use_temp=False).
4. Trigger an error (e.g., incorrect schema setup, missing tables).
5. Observe the logs displaying the full database connection string, including credentials.
Expected behavior
The logs should redact sensitive information from the database connection string. For example, instead of showing the full credentials, it should display something like:
💽 Your data is being persisted to postgresql://****:****@host-url:5432/data-warehouse
Screenshots
N/A
Environment (please complete the following information):
• OS: Windows 11
• Notebook Runtime: Python script (run_phoenix_app.py)
• Browser: N/A
• Version: Phoenix 7.9.2
Additional context
• This issue occurs when launching Phoenix using px.launch_app(use_temp=False). I have not tested whether the same happens with phoenix serve, as the error that triggered the log did not occur in that case.
• A fix should ensure that sensitive credentials are redacted before being logged.
The text was updated successfully, but these errors were encountered:
Describe the bug
When launching Phoenix using px.launch_app(use_temp=False), error logs display the full PostgreSQL connection string, including credentials in plain text. This poses a security risk, as credentials could be leaked in logs, especially in shared environments or CI/CD pipelines.
Example of the log output:
(Note: The credentials in this message have been manually replaced, but they appear in plaintext in the actual logs.)
To Reproduce
Steps to reproduce the behavior:
1. Configure Phoenix to use a PostgreSQL database.
2. Set up environment variables, including the database URL (PHOENIX_SQL_DATABASE_URL).
3. Start the application using px.launch_app(use_temp=False).
4. Trigger an error (e.g., incorrect schema setup, missing tables).
5. Observe the logs displaying the full database connection string, including credentials.
Expected behavior
The logs should redact sensitive information from the database connection string. For example, instead of showing the full credentials, it should display something like:
Screenshots
N/A
Environment (please complete the following information):
• OS: Windows 11
• Notebook Runtime: Python script (run_phoenix_app.py)
• Browser: N/A
• Version: Phoenix 7.9.2
Additional context
• This issue occurs when launching Phoenix using px.launch_app(use_temp=False). I have not tested whether the same happens with phoenix serve, as the error that triggered the log did not occur in that case.
• A fix should ensure that sensitive credentials are redacted before being logged.
The text was updated successfully, but these errors were encountered: