[Security] Address cleartext logging of potentially sensitive information

[sanchitmonga22]

Problem Statement

GitHub security scanning detected potential logging of sensitive data (apiKey) in the logging infrastructure.

What's the issue?

• The logging function at sdk/runanywhere-swift/Sources/RunAnywhere/Infrastructure/Logging/Logging.swift:81 may receive and log sensitive information including API keys
• API keys should never be logged in plaintext
• This could lead to credential exposure through log files

Why does it matter?

• Security concern flagged by GitHub Advanced Security
• Could expose API keys in debug logs, crash reports, or log aggregation systems
• Violates security best practices for credential handling

Current State

• File: sdk/runanywhere-swift/Sources/RunAnywhere/Infrastructure/Logging/Logging.swift
• Line: 81
• Detection: GitHub Advanced Security - Cleartext logging of sensitive information

Proposed Solution

1. Audit all logging call sites - Identify where sensitive data might be passed to logging functions
2. Implement log sanitization - Add redaction for known sensitive patterns (API keys, tokens, etc.)
3. Add documentation - Document which data should never be passed to logging functions
4. Consider structured logging - Use typed log events that explicitly exclude sensitive fields

Example Sanitization Pattern

private func sanitize(_ message: String) -> String {
    // Redact API key patterns
    let apiKeyPattern = /(?:api[_-]?key|apikey|key)[=:]\s*["']?[\w-]+["']?/i
    return message.replacing(apiKeyPattern, with: "[REDACTED]")
}

Implementation Plan

• Audit Logging.swift and all callers
• Implement sanitization for known sensitive patterns
• Add unit tests for sanitization
• Update documentation on secure logging practices
• Verify fix with GitHub security scanning

Success Criteria

• GitHub Advanced Security no longer flags this issue
• Sensitive data patterns are redacted in all log outputs
• Documentation updated with secure logging guidelines

Related Links

• Source comment: [Swift-SDK] [Swift-Sample] Swift SDK Rearchitecture #240 (comment)
• GitHub Security Alert: https://github.com/RunanywhereAI/runanywhere-sdks/security/code-scanning/8

---

🤖 Generated with Claude Code

[sanchitmonga22]

Triage Update (post-refactor audit)

• Status: ✅ VALID
• Impact: High
• Priority suggestion: P0 (confirmed)
• SDK(s): iOS

Current state (post-refactor):

• Old path: sdk/runanywhere-swift/Sources/RunAnywhere/Infrastructure/Logging/Logging.swift:81
• New path: sdk/runanywhere-swift/Sources/RunAnywhere/Infrastructure/Logging/SDKLogger.swift
• The file was refactored/renamed. New location lines 202-230 (core log() method)

What changed:

• ✅ sanitizeMetadata() added at lines 292-309 - redacts keys containing "key", "secret", "password", "token", "auth", "credential" in metadata
• ❌ Message parameter (line 205) is NOT sanitized - sensitive data could still be passed in the message string itself

Why still valid:

• Metadata sanitization exists but message strings are not sanitized
• Caller sites could still log sensitive info via the message parameter
• Audit of all callers still needed to verify no sensitive data leakage
• GitHub security scanning should be re-run after full fix

Proposed direction (no implementation yet):

1. Add message sanitization for common sensitive patterns (API keys, tokens)
2. Audit all logging call sites in the SDK
3. Consider typed log events that structurally exclude sensitive fields

What's needed to execute:

• Full audit of all SDKLogger / Logging.shared.log() call sites
• Message sanitization implementation
• Re-run GitHub security scanning to verify fix

Related: #81 (PII logging of file paths) - distinct but related concern

Success criteria:

• GitHub Advanced Security no longer flags this issue
• Both metadata AND messages sanitized for sensitive patterns
• Documented secure logging guidelines