Notification token is not masked when log is set to debug level

[annamauhaydh]

Checklist:

• I've included steps to reproduce the bug.
• I've included the version of argo rollouts.

Describe the bug

To Reproduce

• set the slack notification with slack token
• set the log level in argo-rollout deployment to debug
• trigger the notification (e.g. change the image tag)

Expected behavior

Notification token should be empty or masked in the logs

Screenshots

Version

v1.8.3

Logs

time="2025-10-01T13:34:33Z" level=debug msg="Sending request: POST /api/chat.postMessage HTTP/1.1\r\nHost: slack.com\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\
...
plain_text<text>&channel=<channel>&text=<text>&token=<token> service=slack

Paste the logs from the rollout controller

Logs for the entire controller:

kubectl logs -n argo-rollouts deployment/argo-rollouts

Logs for a specific rollout:

kubectl logs -n argo-rollouts deployment/argo-rollouts | grep rollout=<ROLLOUTNAME

---
<!-- Issue Author: Don't delete this message to encourage other users to support your issue! -->
**Message from the maintainers**:

Impacted by this bug? Give it a 👍. We prioritize the issues with the most 👍.

[krapie]

Well, I think this actually comes from the notifications-engine module that argo-rollouts uses for notifications. Since it dumps the entire request, it also includes sensitive information such as the Slack token.

func (rt *logRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
	if info, err := httputil.DumpRequest(req, true); err == nil {
		rt.entry.Debugf("Sending request: %s", string(info))

https://github.com/argoproj/notifications-engine/blob/da04400446ffd90d07f74931687a46724cc0d356/pkg/util/http/logroundtripper.go

I think this is expected behavior for debug logging, as we need to see how the request is sent in order to pinpoint the problem. However, if you believe this should be handled differently such as by redacting sensitive data or providing a flag to exclude it, you may need to open an issue in the notifications-engine repository.