From d9f1ab63de0c6f9c035c3858f4e06e32ff37a8de Mon Sep 17 00:00:00 2001 From: mlsmaycon Date: Thu, 20 Aug 2026 00:44:46 +0000 Subject: [PATCH] [misc] Keep vendor listing bodies out of the job log MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The discovery e2e echoed each vendor's whole response into the log. A Bedrock listing embeds inference-profile ARNs, and an ARN carries the 12-digit AWS account id — so every run published one to a log anyone who can see the run can read. Vertex project-scoped responses echo the project id the same way. Log the status instead. The ids line that follows is the finding, and the assertion messages still carry the body, but those render only on a failure that needs diagnosing. --- e2e/agentnetwork/discovery_live_test.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/e2e/agentnetwork/discovery_live_test.go b/e2e/agentnetwork/discovery_live_test.go index 7b87c1594..86f6a4408 100644 --- a/e2e/agentnetwork/discovery_live_test.go +++ b/e2e/agentnetwork/discovery_live_test.go @@ -325,7 +325,12 @@ func runLiveDiscoveryCase(t *testing.T, ctx context.Context, tc liveDiscoveryCas code, body := callUntil(t, func() (int, string, error) { return cl.Get(ctx, endpoint, proxyIP, tc.path, tc.headers) }, 200) - t.Logf("[discovery] %s GET %s -> %d; body: %s", tc.name, tc.path, code, truncate(body, 4000)) + // Status only, not the body. A Bedrock listing embeds inference-profile + // ARNs carrying the 12-digit AWS account id, and these job logs are + // readable by anyone who can see the run. The ids line below is the finding + // anyway; the assertion messages still carry the body, and those only + // render on a failure that needs diagnosing. + t.Logf("[discovery] %s GET %s -> %d", tc.name, tc.path, code) require.Equal(t, 200, code, "%s discovery must be served; body: %s", tc.name, truncate(body, 2000)) ids, ok := listingIDs(body)