opencensus-python icon indicating copy to clipboard operation
opencensus-python copied to clipboard

The Log Analytics Instrumentation Key is Exposed via the File System

Open nigelmeakins opened this issue 3 years ago • 0 comments

When not supplying any storage path to the options object, the default directory used takes the name of the instrumentation key. This then allows someone with file system access to know the Log Analytics Instrumentation Key. This presents significant security issues.

https://github.com/census-instrumentation/opencensus-python/blob/d258dfb710d2d869751816cf759b8e889e4b6a80/contrib/opencensus-ext-azure/opencensus/ext/azure/common/init.py#L68

Could we please change this so that the Log Analytics Instrumentation Key remains hidden from those browsers of the file system? Otherwise we are opening up the Log Analytics workspace to anyone with file system access.

nigelmeakins avatar Jun 25 '22 16:06 nigelmeakins