[ffumero2003]

Context

The bucket notification-rule create / update commands did not set FORBID_LOGGING_ARGUMENTS, so the command dispatcher logged their full argv — including the --sign-secret and --custom-header values.

Change

Set FORBID_LOGGING_ARGUMENTS = True on BucketNotificationRuleCreateBase (inherited by create and update), so these commands' arguments are not written to the command log. (b2sdk's own request logging is separate and out of scope.)

Verification

New test: the --sign-secret value no longer appears in the dispatcher log for create/update, while a normal command still logs its args; removing the flag fails the test. Changelog fragment added.

[sophiecarreras]

Thanks. Two things.

1. The lint job fails in towncrier_check: a changelog entry has to start with a capital letter, and +notification-rule-no-arg-logging.fixed.md starts with a backtick. Starting it with a word, for example "The bucket notification-rule create and update commands no longer log ...", should fix it. (The test jobs show as skipped because lint failed.)

2. Hiding argv in console_tool does not fully stop the secret reaching the debug log. With --verbose or --debug-logs, b2sdk still logs calling Bucket.set_notification_rules(... rules=[... 'hmacSha256SigningSecret': ..., 'customHeaders': {...}]) from b2sdk._internal.bucket, so both the signing secret and the custom-header values are written (to stderr with --verbose, and to b2_cli.log with --debug-logs). I reproduced it by running create with --verbose while capturing all loggers at DEBUG with the patch applied: the console_tool line reads "(arguments hidden)", but the b2sdk line above still carries the values. The new test only reads records from the b2._internal.console_tool logger, so it passes without seeing this.

Could the test assert on all loggers (and on the stderr stream), and the PR either redact those values or note the remaining gap? The comment "b2sdk request logging is handled separately" does not match what I see today. Redacting in the b2sdk call-trace logging, or not enabling DEBUG tracing for these commands, would both close it.

For the scope of this change, the approach looks right otherwise: Update inherits from the base so both commands are covered, I found no other argv-borne secrets (SSE-C keys come from environment variables), and hiding --webhook-url too is a good call. code/snyk also reports "1 new Code Analysis issue"; I could not open the detail, it may be the hard-coded test secret.

[sophiecarreras]

Review from Sofia, with Claude's help. Read only, not run.

One blocker: lint is red. The Changelog validation step fails with File +notification-rule-no-arg-logging.fixed.md is not a valid changelog entry: The first character is not a capital letter. The fragment starts with a backtick. Start it with a capital letter, for example "The bucket notification-rule create and ...".

One question about the test. test_notification_rules__sensitive_arguments_are_not_logged asserts only on records from the b2._internal.console_tool logger. With --verbose, b2sdk's own request logging could still print the signing secret and header values from the request body, and this test would not see it. The PR calls that out of scope; can you check whether b2sdk logs the request body at --verbose? If it does, the secret still reaches the debug log by another route.

The change itself (FORBID_LOGGING_ARGUMENTS = True on the shared base, with create and update both parametrized) looks right.

Comment only, not an approval.

[ffumero2003]

Thanks @sophiecarreras — both points addressed in e5088a0 (CI green: lint, snyk and the full matrix pass):

• Fixed (the blocker) — the changelog fragment now starts with a capital letter, so towncrier_check passes.
• Fixed (the real leak you found) — you were right that hiding argv wasn't enough. The notification-rule commands now raise the b2sdk._internal.bucket logger to at least INFO for the duration of the command and restore the previous level afterward (even on error), so the SDK's own DEBUG request-body trace — which carried the signing secret and custom-header values — is suppressed under --verbose and --debug-logs. The misleading # b2sdk request logging is handled separately comment is gone.
• Fixed (the test gap) — the regression test now captures all loggers, stderr and b2_cli.log, across both create/update and both command spellings, and asserts the secret and header values never appear. Removing the SDK-logging scope makes it fail (12 red → 12 green).
• Fixed (snyk) — replaced the key-shaped fixture with clearly synthetic values; code/snyk is green.

Re-requesting your review.