Skip to content

fix: make trace_include_sensitive_data default to False for security #2392

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
OpenSourceSoul wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

fix: make trace_include_sensitive_data default to False for security #2392

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/agents/run_config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@

def _default_trace_include_sensitive_data() -> bool:
"""Return the default for trace_include_sensitive_data based on environment."""
val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "true")
val = os.getenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", "false")
return val.strip().lower() in ("1", "true", "yes", "on")


Expand Down
7 changes: 4 additions & 3 deletions src/agents/voice/pipeline_config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,10 @@ class VoicePipelineConfig:
tracing: TracingConfig | None = None
"""Tracing configuration for this pipeline."""

trace_include_sensitive_data: bool = True
"""Whether to include sensitive data in traces. Defaults to `True`. This is specifically for the
voice pipeline, and not for anything that goes on inside your Workflow."""
trace_include_sensitive_data: bool = False
"""Whether to include sensitive data in traces. Defaults to `False` for security. When enabled,
tool inputs/outputs and LLM generations may be exposed in traces. Only enable in trusted
environments."""

trace_include_sensitive_audio_data: bool = True
"""Whether to include audio data in traces. Defaults to `True`."""
Expand Down
6 changes: 3 additions & 3 deletions tests/test_run_config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,11 +88,11 @@ async def test_agent_model_object_is_used_when_present() -> None:
assert result.final_output == "from-agent-object"


def test_trace_include_sensitive_data_defaults_to_true_when_env_not_set(monkeypatch):
"""By default, trace_include_sensitive_data should be True when the env is not set."""
def test_trace_include_sensitive_data_defaults_to_false_when_env_not_set(monkeypatch):
"""By default, trace_include_sensitive_data should be False for security when the env is not set."""
monkeypatch.delenv("OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA", raising=False)
config = RunConfig()
assert config.trace_include_sensitive_data is True
assert config.trace_include_sensitive_data is False


@pytest.mark.parametrize(
Expand Down
Loading