counselos stops Mike from leaking privileged documents into the logs

A legal-AI fork quietly closes a hole that was writing document excerpts and file names into production logs by default.

securitycompliance

counselos found that the document-reading part of this fork was chattier than anyone intended. Every time it opened a file, it was recording the filename, the storage location, and a slice of the actual extracted text - and it was doing this in production, all the time. Anywhere those logs landed (a monitoring tool, a cloud provider's log storage, a security dashboard), pieces of the underlying documents were landing with them.

The fix puts all the content-revealing logging behind a switch that stays off unless someone deliberately turns it on for debugging. Routine logs that don't touch document text - errors, request counts, startup messages - are left alone. So engineers can still dig in when they need to, but a live deployment no longer spills document contents into places nobody was watching.

So what Anyone running a legal-AI tool on privileged material should care: logs are an easy place for confidential text to escape, and this is the kind of leak that's invisible until an audit finds it.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from counselos/mike-inhouse, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date
88922de2 fix: gate content-bearing LLM and document logs behind MIKE_DEBUG_STREAMS counselos 2026-05-04 ↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-72.md from inside the repo you want the changes in.

⬇ Download capture-thread-72.md