fix: remove raw vars from config trace log to prevent token leak (#190)

vinayada1 · web-flow · commit e5bb7dbbce6d · 2026-04-07T12:44:29.000-05:00
diff --git a/config/config.go b/config/config.go
@@ -142,7 +142,6 @@ func NewConfig(requiredVars []string) Config {
 		"invasive", invasive,
 		"applicability", applicability,
 		"control-catalogs", catalogs,
-		"vars", vars,
 		"output", output,
 	)
 	return config
@@ -158,7 +157,7 @@ func printSanitizedVars(logger hclog.Logger, vars map[string]interface{}) {
 			sanitizedVars[key] = value
 		}
 	}
-	logger.Trace("Using vars: %v", sanitizedVars)
+	logger.Trace("Using vars", "vars", sanitizedVars)
 }
 
 func defaultWritePath() string {

Original file line number	Diff line number	Diff line change
`@@ -142,7 +142,6 @@ func NewConfig(requiredVars []string) Config {`
`142`	`142`	`"invasive", invasive,`
`143`	`143`	`"applicability", applicability,`
`144`	`144`	`"control-catalogs", catalogs,`
`145`		`- "vars", vars,`
`146`	`145`	`"output", output,`
`147`	`146`	`)`
`148`	`147`	`return config`
`@@ -158,7 +157,7 @@ func printSanitizedVars(logger hclog.Logger, vars map[string]interface{}) {`
`158`	`157`	`sanitizedVars[key] = value`
`159`	`158`	`}`
`160`	`159`	`}`
`161`		`- logger.Trace("Using vars: %v", sanitizedVars)`
	`160`	`+ logger.Trace("Using vars", "vars", sanitizedVars)`
`162`	`161`	`}`
`163`	`162`
`164`	`163`	`func defaultWritePath() string {`