Repository navigation
Feature request: Mask repository credentials in --verbose output #254
Description
Summary
Currently, if command line flag --verbose is given, python-inspector outputs all repositories and their respective credentials, including username and password in plain text.
In order to reduce the risk of an adversary gaining access to the password, please add masking of passwords in the printer that prints the log output.
Current behavior
When running python-inspector with --verbose, the tool prints information about all configured repositories, including:
- Repository URL or name
- Username
- Password in plain text
This means anyone with access to logs (local logs, CI logs, support dumps, etc.) can see the full password.
Requested behaviour
When the printer outputs credentials in --verbose mode, apply the following masking rules to the password:
- If the password has a length of less than 12 characters, output only:
*** - Else (password length ≥ 12), print: the first 3 characters of the password, then
***, then the last 3 characters of the password.
Example:abc***xyz
The username and other non-secret fields can remain unchanged.
Rationale
This feature would:
- Reduce the risk of leaking passwords to an acceptable level, because the full password is never printed.
- Still keep
--verboseuseful for support and maintenance: One can still verify whether the password used is the expected one by checking the visible prefix and suffix.
To stress it again:
Masking out the password completely would render the --verbose switch useless for troubleshooting.
The proposed partial masking (abc***xyz) keeps both security and usability in balance.
Activity
mnonnenmacher commentedon Nov 7, 2025
I would be in favor of completely masking password in all cases because exposing parts of them already makes them less secure.
feat(pip): Add 'verbose' option to enable detailed resolver output
wkl3nk commentedon Nov 7, 2025
But @mnonnenmacher you know our troubles with support, passwords and token expiry, and then it would be absolutely helpful to be able to compare 6 characters in order to confirm that the password is (probably) correct or outdated. In the support case I am currently working on, the password has a length of 64 characters. I don't think that revealing 6 characters of them should be a problem, but would provide a big benefit for support and bug analysis.
mnonnenmacher commentedon Nov 7, 2025
Yes, I know the struggles, but security best practices should be followed anyway. I think the situation can already be improved by logging more metadata about used secrets on our side, and maybe also in python-inspector by logging more information about where the password is taken from.
feat(pip): Add 'verbose' option to enable detailed resolver output
feat(pip): Add 'pythonInspectorVerbose' option to enable detailed output
Rajeshwari2857 commentedon Oct 24, 2026
Hi!
I've updated the implementation to mask passwords in the repository's
repr()output while keeping non-secret fields, such as the username, visible for debugging.All 14 tests in
tests/test_utils.pypass locally, and the regular CI test jobs and code checks are passing. However, the three online-test jobs are still failing, and I haven't been able to determine the cause from the pipeline logs I've inspected.Could someone help confirm whether these online-test failures are reproducible or point me toward the relevant failure logs? I'd appreciate any guidance on the remaining checks.
Im also open to completely hiding the credentials and will do the required changes if thats the final decision, please let me know.