From a3e8c2d1485ed9490c4a2584248aaffaa3a13a3c Mon Sep 17 00:00:00 2001 From: Ishaan Jaff Date: Fri, 5 Dec 2025 15:09:33 -0800 Subject: [PATCH] Potential fix for code scanning alert no. 3873: Clear-text logging of sensitive information Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- litellm/proxy/hooks/dynamic_rate_limiter_v3.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/hooks/dynamic_rate_limiter_v3.py b/litellm/proxy/hooks/dynamic_rate_limiter_v3.py index 6576f626bc8..d091e348020 100644 --- a/litellm/proxy/hooks/dynamic_rate_limiter_v3.py +++ b/litellm/proxy/hooks/dynamic_rate_limiter_v3.py @@ -720,9 +720,12 @@ class _PROXY_DynamicRateLimitHandlerV3(CustomLogger): parent_otel_span=litellm_parent_otel_span, ) + # Only log 'priority' if it's known safe; otherwise, redact. + SAFE_PRIORITIES = {"low", "medium", "high", "default"} + logged_priority = key_priority if key_priority in SAFE_PRIORITIES else "REDACTED" verbose_proxy_logger.debug( f"[Dynamic Rate Limiter] Incremented tokens by {total_tokens} for " - f"model={model_group}, priority={key_priority or 'default'}" + f"model={model_group}, priority={logged_priority}" ) except Exception as e: