counselos plugs a quiet leak in Mike's debug logs

Document text and filenames were quietly bleeding into stdout - and from there into backups and monitoring tools. counselos shut the tap.

securitycompliance

Mike's chat tooling has long printed verbose debug lines as it reads documents, builds context, and streams answers from the underlying AI models. Useful when you're developing - quietly dangerous in production, where anything written to stdout tends to get swept up by log aggregators, SIEM systems, and backup tapes. For a fork like counselos/mike-inhouse, pointed at privileged client work, that's a paper trail nobody asked for.

The fix is small and disciplined: every log line that carries actual document content or storage paths is now gated behind a debug flag that's off by default. Read failures still surface so operators can tell when something breaks - they just no longer come with the document attached. A short note in the code spells out the threat model so the next contributor doesn't undo it by accident.

So what Anyone running a legal-AI tool on real client matters should check what their chat backend is writing to logs - this is the kind of leak that only shows up in a breach review.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from counselos/mike-inhouse, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date
88922de2 fix: gate content-bearing LLM and document logs behind MIKE_DEBUG_STREAMS counselos 2026-05-04 ↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-72.md from inside the repo you want the changes in.

⬇ Download capture-thread-72.md