counselos stops Mike from leaking privileged documents into the logs
A legal-AI fork quietly closes a hole that was writing document excerpts and file names into production logs by default.
counselos found that the document-reading part of this fork was chattier than anyone intended. Every time it opened a file, it was recording the filename, the storage location, and a slice of the actual extracted text - and it was doing this in production, all the time. Anywhere those logs landed (a monitoring tool, a cloud provider's log storage, a security dashboard), pieces of the underlying documents were landing with them.
The fix puts all the content-revealing logging behind a switch that stays off unless someone deliberately turns it on for debugging. Routine logs that don't touch document text - errors, request counts, startup messages - are left alone. So engineers can still dig in when they need to, but a live deployment no longer spills document contents into places nobody was watching.
Spotted something wrong? Or know the PR text has fresher detail than the writeup above?