opencensus-python
opencensus-python copied to clipboard
The Log Analytics Instrumentation Key is Exposed via the File System
When not supplying any storage path to the options object, the default directory used takes the name of the instrumentation key. This then allows someone with file system access to know the Log Analytics Instrumentation Key. This presents significant security issues.
https://github.com/census-instrumentation/opencensus-python/blob/d258dfb710d2d869751816cf759b8e889e4b6a80/contrib/opencensus-ext-azure/opencensus/ext/azure/common/init.py#L68
Could we please change this so that the Log Analytics Instrumentation Key remains hidden from those browsers of the file system? Otherwise we are opening up the Log Analytics workspace to anyone with file system access.