{"action":"created","issue":{"url":"https://api.github.com/repos/Microsoft/vso-agent-tasks/issues/833","labels_url":"https://api.github.com/repos/Microsoft/vso-agent-tasks/issues/833/labels{/name}","comments_url":"https://api.github.com/repos/Microsoft/vso-agent-tasks/issues/833/comments","events_url":"https://api.github.com/repos/Microsoft/vso-agent-tasks/issues/833/events","html_url":"https://github.com/Microsoft/vso-agent-tasks/issues/833","id":117712584,"number":833,"title":"Suppress credentials / API keys from logs in tool runs like NuGet","user":{"login":"tillig","id":1156571,"avatar_url":"https://avatars.githubusercontent.com/u/1156571?v=3","gravatar_id":"","url":"https://api.github.com/users/tillig","html_url":"https://github.com/tillig","followers_url":"https://api.github.com/users/tillig/followers","following_url":"https://api.github.com/users/tillig/following{/other_user}","gists_url":"https://api.github.com/users/tillig/gists{/gist_id}","starred_url":"https://api.github.com/users/tillig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tillig/subscriptions","organizations_url":"https://api.github.com/users/tillig/orgs","repos_url":"https://api.github.com/users/tillig/repos","events_url":"https://api.github.com/users/tillig/events{/privacy}","received_events_url":"https://api.github.com/users/tillig/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-11-19T00:21:07Z","updated_at":"2015-11-19T16:48:33Z","closed_at":null,"body":"When you run a task like the NuGet publisher the invocation of the tool logs the API key and/or credentials in the build log. Users with access to the build log may not actually have the credentials to perform the actions the build server is performing, so logging this information creates a security risk. It allows anyone with access to the build log to execute commands using the build server's credentials.\r\n\r\nParticularly in the case of NuGet, this somewhat defeats the purpose of maintaining NuGet endpoints or credentials in the Service Endpoints repository; it's all going to get dumped out in plaintext right in the log."},"comment":{"url":"https://api.github.com/repos/Microsoft/vso-agent-tasks/issues/comments/158115239","html_url":"https://github.com/Microsoft/vso-agent-tasks/issues/833#issuecomment-158115239","issue_url":"https://api.github.com/repos/Microsoft/vso-agent-tasks/issues/833","id":158115239,"user":{"login":"tillig","id":1156571,"avatar_url":"https://avatars.githubusercontent.com/u/1156571?v=3","gravatar_id":"","url":"https://api.github.com/users/tillig","html_url":"https://github.com/tillig","followers_url":"https://api.github.com/users/tillig/followers","following_url":"https://api.github.com/users/tillig/following{/other_user}","gists_url":"https://api.github.com/users/tillig/gists{/gist_id}","starred_url":"https://api.github.com/users/tillig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tillig/subscriptions","organizations_url":"https://api.github.com/users/tillig/orgs","repos_url":"https://api.github.com/users/tillig/repos","events_url":"https://api.github.com/users/tillig/events{/privacy}","received_events_url":"https://api.github.com/users/tillig/received_events","type":"User","site_admin":false},"created_at":"2015-11-19T16:48:33Z","updated_at":"2015-11-19T16:48:33Z","body":"Nice. It's like you guys are reading my mind. Very cool, gang, very cool."}}