[Bug]: Redis connection URL (including password) logged at INFO level — credential exposure in logs

[rahuldass19]

The problem

The Redis connection URL (which may include a password) is logged at INFO level during startup, exposing credentials in plaintext in server logs.

Code evidence

redis_config.py:57 — logs the full Redis URL including password:

logger.info(f"Connecting to Redis at {redis_url}")

If redis_url is formatted as redis://:password@host:6379, the log output will contain the password.

Contrast with database.py

database.py:21 correctly hides the password:

logger.info(f"Connecting to database at {sanitize_url(db_url)}")

where sanitize_url() strips the password component from the URL before logging.

Why this matters

1. Credential exposure in logs — server logs often have broader access than the production database. Anyone with log access (devops, support, incident responders) can see the Redis password.
2. Log aggregation systems — if logs are shipped to a centralized system (CloudWatch, Datadog, ELK), the password propagates to every system that stores or indexes logs.
3. Inconsistent treatment — the database URL is correctly sanitized before logging, while the Redis URL is not. The fix is known and already implemented for one code path.

Locations

• src/qwed_new/core/redis_config.py:57 — logger.info(f"Connecting to Redis at {redis_url}")
• src/qwed_new/core/database.py:21 — reference implementation of correct sanitization

Suggested fix

1. Extract sanitize_url() (or equivalent) from database.py into a shared utility.
2. Use it in redis_config.py:57 before logging the Redis URL.
3. Audit all other logger.info / logger.debug calls that might log connection strings or URLs with embedded credentials.

Acceptance criteria

• Redis URL logged without password component
• Database URL still logged without password component (no regression)
• URL sanitization is in a shared utility, not duplicated
• Audit finds no other log statements exposing credentials