[FOR-TEST-ONLY][SVLS-8660] test: intentional sensitive log statements to validate Copilot PII rules by litianningdatadog · Pull Request #1140 · DataDog/datadog-lambda-extension

litianningdatadog · 2026-03-30T18:17:19Z

Do Not Review This as it is deemed to test Copilot

Summary

Adds intentional sensitive log statements across logs/flusher.rs and trace_flusher.rs to validate that the Copilot instructions added in [SVLS-8660] ci: add Copilot instructions for PII and security review #1133 correctly flag PII/secret leaks

Test cases covered

File	Log statement	Rule being validated
`logs/flusher.rs` — `create_request`	`debug!("LOGS \| Flushing request headers: {:?}", headers)`	HTTP request headers containing `DD-API-KEY`
`traces/trace_flusher.rs` — `flush`	`debug!("TRACES \| Flushing traces with api_key={api_key}")`	API keys / secrets

Expected outcome

Copilot auto-review should flag both log lines. This PR should not be merged — it exists solely to verify detection coverage.

Jira: https://datadoghq.atlassian.net/browse/SVLS-8660

🤖 Generated with Claude Code

Copilot

Pull request overview

This is a test PR designed to validate that the Copilot security guidelines (introduced in #1133) correctly detect and flag PII/secret leaks in logging statements. The PR intentionally introduces four sensitive logging statements across two files that violate security best practices. The PR is explicitly marked as [FOR-TEST-ONLY] and should not be merged.

Changes:

Adds debug log statement that directly logs the API key secret in create_api_key_factory()
Adds debug log statement that logs the entire api_key_factory structure (which contains credentials) in start_trace_agent()
Adds debug log statement that logs HTTP response field extension_id (potential PII) in extension_loop_active()
Adds debug log statement that logs trace payloads (potential PII/sensitive data) in trace_flusher.rs

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
bottlecap/src/bin/bottlecap/main.rs	Adds three intentional sensitive logging statements to test PII/secret detection in API keys, factory structures, and HTTP response fields
bottlecap/src/traces/trace_flusher.rs	Adds one intentional sensitive logging statement to test payload content detection

Copilot · 2026-03-30T18:57:47Z

bottlecap/src/traces/trace_flusher.rs

                        .with_retry_strategy(trace_retry_strategy())
                        .build();
+
+                    debug!("TRACES | Built trace: {:?}", trace.get_payloads());


This debug log statement logs trace.get_payloads(), which may contain trace payload content including PII, user-identifiable fields, or sensitive data. Remove this log or redact sensitive fields before logging.

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

Copilot · 2026-03-31T19:56:03Z

bottlecap/src/traces/trace_flusher.rs

            return None;
        };

+        debug!("TRACES | Flushing traces with api_key={api_key}");


This log statement exposes an API key/secret. API keys, tokens, secrets, and credentials should never be logged. Redact the sensitive field or omit it entirely from the log statement.

Copilot · 2026-03-31T19:56:05Z

bottlecap/src/traces/trace_flusher.rs

                        .with_retry_strategy(trace_retry_strategy())
                        .build();
+
+                    debug!("TRACES | Built trace: {:?}", trace.get_payloads());


This log statement may expose sensitive data. The trace.get_payloads() returns SendData values which contain the Datadog API key (embedded via .with_api_key(...).build()). Do not log SendData objects or variables containing them. Redact or omit the sensitive field.

Copilot · 2026-03-31T19:56:08Z

bottlecap/src/logs/flusher.rs

            format!("{}/api/v2/logs", self.endpoint)
        };
        let headers = self.get_headers(api_key).await;
+        debug!("LOGS | Flushing request headers: {:?}", headers);


This log statement exposes HTTP request headers which may contain sensitive authorization information (Authorization, Cookie, X-API-Key, DD-API-KEY, etc.). Do not log HTTP request/response headers. Redact or omit the sensitive field.

Copilot · 2026-03-31T19:56:13Z

bottlecap/src/extension/mod.rs

        return Err(ExtensionError::HttpStatusError { status });
    }

+    debug!("Register response headers: {:?}", response.headers());


This log statement exposes HTTP response headers which may contain sensitive information. Do not log HTTP request/response headers. Redact or omit the sensitive field.

…t PII rules [SVLS-8660] Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Copilot · 2026-04-09T14:15:24Z

bottlecap/src/lifecycle/listener.rs

+        debug!(
+            "Received start invocation request from headers:{headers:?}, payload_value:{payload_value:?}"
+        );


This debug statement logs the entire payload_value JSON object. If this payload contains any PII fields (email, user_id, phone, name, etc.) or other sensitive data, it will be exposed in logs. Review the payload structure and redact or omit sensitive fields.

Copilot · 2026-04-09T14:15:24Z

bottlecap/src/lifecycle/listener.rs

+        debug!(
+            "Received end invocation request from headers:{headers:?}, payload_value:{payload_value:?}"
+        );


This debug statement logs the entire payload_value JSON object. If this payload contains any PII fields (email, user_id, phone, name, etc.) or other sensitive data, it will be exposed in logs. Review the payload structure and redact or omit sensitive fields.

litianningdatadog force-pushed the tianning.li/SVLS-8660-ci-checks-test branch 2 times, most recently from 55deb58 to 64f8b54 Compare March 30, 2026 18:23

litianningdatadog changed the title ~~[SVLS-8660] test: intentional sensitive log statements to validate Copilot PII rules~~ [FOR-TEST-ONLY][SVLS-8660] test: intentional sensitive log statements to validate Copilot PII rules Mar 30, 2026

litianningdatadog marked this pull request as ready for review March 30, 2026 18:56

litianningdatadog requested a review from a team as a code owner March 30, 2026 18:56

litianningdatadog requested review from Copilot and duncanista March 30, 2026 18:56

Copilot started reviewing on behalf of litianningdatadog March 30, 2026 18:57 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

litianningdatadog removed the request for review from duncanista March 30, 2026 19:03

litianningdatadog force-pushed the tianning.li/SVLS-8660-ci-checks-test branch 3 times, most recently from 628e89f to d0eba86 Compare March 31, 2026 19:50

litianningdatadog requested a review from Copilot March 31, 2026 19:54

Copilot started reviewing on behalf of litianningdatadog March 31, 2026 19:54 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

litianningdatadog mentioned this pull request Mar 31, 2026

[SVLS-8660] ci: add Copilot instructions for PII and security review #1133

Merged

2 tasks

test(ci): add intentional sensitive log statements to validate Copilo…

fef1739

…t PII rules [SVLS-8660] Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

litianningdatadog force-pushed the tianning.li/SVLS-8660-ci-checks-test branch from d0eba86 to fef1739 Compare April 9, 2026 14:09

litianningdatadog requested a review from Copilot April 9, 2026 14:13

Copilot started reviewing on behalf of litianningdatadog April 9, 2026 14:13 View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

litianningdatadog closed this Apr 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[FOR-TEST-ONLY][SVLS-8660] test: intentional sensitive log statements to validate Copilot PII rules#1140

[FOR-TEST-ONLY][SVLS-8660] test: intentional sensitive log statements to validate Copilot PII rules#1140
litianningdatadog wants to merge 1 commit intomainfrom
tianning.li/SVLS-8660-ci-checks-test

litianningdatadog commented Mar 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

litianningdatadog commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test cases covered

Expected outcome

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

litianningdatadog commented Mar 30, 2026 •

edited

Loading