From 95faf1e419393338efb5fa7a743da6a316e96231 Mon Sep 17 00:00:00 2001 From: Alexey Matvievsky Date: Wed, 1 Jul 2026 21:47:14 +0300 Subject: [PATCH] security: redact bot token from GetUpdatesChan error logs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GetUpdatesChan logs transport-level errors verbatim via log.Println(err). A *url.Error's message embeds the full request URL, and the Bot API's own design puts the token in that URL (https://api.telegram.org/bot/...). A transient network blip (e.g. "unexpected EOF") is enough to put a live bot token in cleartext in application logs — discovered in production when this happened to us and the token ended up visible in our own log output. Redacts bot.Token out of the error message before logging. --- bot.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bot.go b/bot.go index 39037b8d..2329d662 100644 --- a/bot.go +++ b/bot.go @@ -441,7 +441,11 @@ func (bot *BotAPI) GetUpdatesChan(config UpdateConfig) UpdatesChannel { updates, err := bot.GetUpdates(config) if err != nil { - log.Println(err) + // Transport-level errors (e.g. "unexpected EOF") come back as a + // *url.Error whose message embeds the full request URL — and the + // bot token is part of that URL, so logging err verbatim leaks + // it in cleartext. Redact before printing. + log.Println(strings.ReplaceAll(err.Error(), bot.Token, "[REDACTED]")) log.Println("Failed to get updates, retrying in 3 seconds...") time.Sleep(time.Second * 3)