Audit other LIF services for DATABASE_URL log-leak pattern

[bjagg]

Follow-up to #938 / PR #951.

What

The pattern logger.info(f"DATABASE_URL : {DATABASE_URL}") lived in components/lif/mdr_utils/database_setup.py. It's plausibly been copied into other service-side modules in this monorepo. Audit + fix.

Likely suspects

• components/lif/graphql_*/...
• components/lif/translator_*/...
• components/lif/advisor_api/... (and any other *_api)
• components/lif/query_cache_*/...
• components/lif/identity_mapper/...
• orchestrators/dagster/... (Dagster jobs use their own DB; same pattern risk)

Approach

Quick grep:

grep -rnE 'DATABASE_URL\s*:?\s*\{|logger\.info.*DATABASE_URL|logger\.info.*postgres(ql)?://' \
  components/ bases/ projects/ orchestrators/

For any hit, apply the same fix shape as PR #951: redact the password before logging (extract _redact_url to a shared util if more than one service needs it).

Definition of done

• grep returns no matches for the leaking pattern.
• Any module that does log a connection URL routes through a redacting helper.
• Spot-check production log groups for the dev / demo equivalents of the affected services.

Related

• MDR API logs DATABASE_URL with plaintext credentials at startup #938 — original finding in mdr_utils
• PR Issue #938: Redact DATABASE_URL password before logging at startup #951 — the fix in mdr_utils (template for this audit)
• Self-Serve MDR: Security review / threat model #937 — security review umbrella

[bjagg]

Audit complete — no propagation needed. The DATABASE_URL log-leak pattern from #938 exists in exactly one place in the monorepo (components/lif/mdr_utils/database_setup.py:19), which is already fixed by PR #951.

What I grepped

• logger.(info|debug|warning|error)(.*DATABASE_URL|.*postgres(ql)?://) across components/, bases/, projects/, orchestrators/, scripts/
• f-string interpolation of any *_PASSWORD env var into a string passed to a logger
• Anywhere create_engine / create_async_engine is followed by a logging call

What I found

Module	Verdict
components/lif/mdr_utils/database_setup.py:19	The original. Fixed in PR #951.
components/lif/identity_mapper_storage_sql/db.py	Uses URL.create(...) constructor (parameterized, never f-string'd into a log line). Safe.
data_source_adapters/example_data_source_rest_api_to_lif_adapter/adapter.py:31	Logs source_url, but the credential (x-key token) is in a separate header; URL contains scheme/host/path only. Safe.
bases/lif/api_graphql/core.py:26-28	Logs LIF_QUERY_PLANNER_URL / LIF_MDR_API_URL — service URLs with no credentials. Safe.
Everything else	request.url.path logging of incoming HTTP requests — not connection strings. Safe.

Adjacent finding (filed separately)

database_setup.py:21 uses create_async_engine(..., echo=True) which logs every SQL statement and its bound parameters. Not a credential leak, but related log-volume + soft-leak concern. Tracked as the next-numbered issue.

Closing as completed.