From 0a131145367e79cf35b13dc59ef723607f36f257 Mon Sep 17 00:00:00 2001 From: Alexsander Hamir Date: Wed, 19 Nov 2025 19:15:28 -0800 Subject: [PATCH] [Fix] Security - Filter secret fields form Langfuse (#16842) * fix: remove secret fields from logs * fix: remove secret fields from otel --- litellm/integrations/arize/_utils.py | 3 +++ litellm/integrations/langfuse/langfuse.py | 2 ++ 2 files changed, 5 insertions(+) diff --git a/litellm/integrations/arize/_utils.py b/litellm/integrations/arize/_utils.py index 10597d6e713..c9a1531b5d4 100644 --- a/litellm/integrations/arize/_utils.py +++ b/litellm/integrations/arize/_utils.py @@ -208,7 +208,10 @@ def set_attributes( ) try: + # Remove secret_fields to prevent leaking sensitive data (e.g., authorization headers) optional_params = kwargs.get("optional_params", {}) + if isinstance(optional_params, dict): + optional_params.pop("secret_fields", None) litellm_params = kwargs.get("litellm_params", {}) standard_logging_payload: Optional[StandardLoggingPayload] = kwargs.get( "standard_logging_object" diff --git a/litellm/integrations/langfuse/langfuse.py b/litellm/integrations/langfuse/langfuse.py index c2a2cc77950..12eb00efa9e 100644 --- a/litellm/integrations/langfuse/langfuse.py +++ b/litellm/integrations/langfuse/langfuse.py @@ -228,6 +228,8 @@ class LangFuseLogger: functions = optional_params.pop("functions", None) tools = optional_params.pop("tools", None) + # Remove secret_fields to prevent leaking sensitive data (e.g., authorization headers) + optional_params.pop("secret_fields", None) if functions is not None: prompt["functions"] = functions if tools is not None: