[BUG] Beelzebub debug logs expose OpenAI API keys

[pzr21]

Describe the bug
Beelzebub logs sensitive configuration data in debug mode without sanitization. The service configuration dump includes LLM plugin secrets such as OpenAISecretKey, allowing OpenAI API keys to be exposed through application logs when debug logging is enabled.

To Reproduce

1. Create a service configuration containing a marker OpenAI API key:

plugin:
  llmProvider: "openai"
  llmModel: "gpt-4o-mini"
  openAISecretKey: "sk-beelzebub-debug-leak-marker"

2. Enable debug logging and start Beelzebub with this configuration:

./beelzebub --log-level debug \
  --conf-core <core-config> \
  --conf-services <service-config-dir> \
  run

3. Inspect the debug output or log file:

grep 'sk-beelzebub-debug-leak-marker' <log-file>

Actual behavior
The marker secret appeared in the debug output:

level=debug msg="&{Plugin:{OpenAISecretKey:sk-beelzebub-debug-leak-marker Model:gpt-4o-mini}}"

Expected behavior
Debug logging should redact sensitive fields such as OpenAI API keys before writing configuration or HTTP client state to logs.

Version
beelzebub: v3.0.0
OS: Ubuntu 22.04 LTS, Linux 6.5.13-5-pve, x86-64

[mariocandela]

Thank you for reporting this!

Debug mode is designed to trace everything happening in the runtime, but sensitive values should still be protected. Replacing the secret with [REDACTED], or completely hiding the Authorization header, would be a good solution.

If you’d like, feel free to open an MR for this and contribute to the project—we’d be happy to review it! 💌